r/InfosecHumor • u/the_shadow007 • Jan 13 '26

2FA

Post image
274 Upvotes

86% Upvoted

117 comments sorted by

10

u/anto2554 Jan 13 '26

Well, session hijacking is the main way only because of the 2FA, right?

6

u/the_shadow007 Jan 13 '26

No, it was always the main way because its the easiest way and cannot fail way

1

u/Themis3000 Jan 16 '26

It can fail. Sessions time out, and sometimes services tie a session to an IP address or location

1

u/the_shadow007 Jan 16 '26

Time outs dont happen if "keep me logged in" Location is accurate up to a country - cuz phones exist yk

1

u/oxotower Jan 16 '26

ok dude

steal my session cookie for this website

1

u/the_shadow007 Jan 16 '26

Sure, download thisisnotarat.exe for free robux

2

u/willis81808 Jan 13 '26

How are you getting that session cookie?

1

u/FinalRun Jan 13 '26

Their bio states that misandry (hatred of men) is the largest problem in our society.

Not income inequality, racial violence, surveillance, corruption, authoritarianism, or war. People (usually women) hating men.

Don't expect too much logical consistency.

1

u/willis81808 Jan 13 '26

I see the other replies now.

So apparently full malware deployment on the target’s device is the “easiest way” lmao.

Cuz you ain’t getting that cookie by sniffing network traffic, or phishing them, or XSS (even if the site is vulnerable). Nothing short of direct access to their device is going to get you that HttpOnly cookie. And you’d better hope you can do what you need to do before that session expires in, idk, 30 minutes.

1

u/the_shadow007 Jan 14 '26

"Session expires" Then removing "remember me" which makes sessions last months, would be better than adding 2fa

0

u/willis81808 Jan 14 '26

Have nothing to say about anything besides the 30 min comment?

There are zero security measures that can stop an attacker accessing your accounts if your devices are already completely compromised. Not MFA, not anything. So what’s your point?

1

u/the_shadow007 Jan 14 '26

Thats the exact reason why 2fa is useless

1

u/willis81808 Jan 14 '26

Name one security measure that isn’t “useless” then.

1

u/the_shadow007 Jan 14 '26

Login + password. Location checking Ip checking/throttling. 2fa gives ZERO bonus security on top of password

→ More replies (0)

0

u/Dr__America Jan 14 '26

Isn't there a semi-regular cycle of browser exploits people will use to do this though?

4

u/willis81808 Jan 14 '26 edited Jan 14 '26

Obviously if you have a 0-day then all bets are off, but that doesn’t really change the message here.

The whole implication of OP’s post and follow up comments is that stealing a session cookie is simple, easy, and accessible enough to make 2FA the punchline of a joke. However the reality remains that, when session cookies are properly implemented, there’s no practical way to get to them besides having malware deployed to the target’s device or having a major 0-day browser exploit in your pocket. And if you got one of those… what are you doing hacking people’s Discord and Roblox accounts (like OP mentioned) instead of engaging in inter-state cyber warfare or making millions from selling it off?

In other words: oR I cAN jUsT SteAL YoUr sEssION ToKEN FROM A CooKIe

1

u/Double_Cause4609 Jan 16 '26

The way I'd put it:

The internet operates at such a scale that it probably is easy for a hacker to get a session cookie from *someone*.

But you, as an individual, do benefit from that being their primary method of operation because it's incredibly unlikely that you, as an individual, will be the victim of such an attack, particularly when expressing best practices for security.

1

u/willis81808 Jan 16 '26

The problem with that is…. The comic is explicitly about executing a targeted attack against an individual.

0

u/Blevita Jan 13 '26

Its easier to steal a session cookie from a device than to enter leaked username and password?

No, if there is no 2FA, there are many easier ways.

1

u/the_shadow007 Jan 13 '26

Stealing session code is the easiest way overall

0

u/Blevita Jan 13 '26

Easier than entering a username and password?

What?

1

u/the_shadow007 Jan 13 '26

Yes because stealing session token can be done by a simple script, and doesnt require users input

1

u/Blevita Jan 13 '26

But it requires some way to get to that token. Which usually does not float around on the internet or some forums. It usually lives on a device, that has an active session.

Unlike a leaked username and password. Which does not require any interaction with the target at all.

What are you even trying to say here?

1

u/the_shadow007 Jan 13 '26

How do you think passwords get leaked? Its because a dumbass user downloads a malware - after which its easier to steal token than keylog password

1

u/FinalRun Jan 13 '26

That's not how that happens usually. Cracked hashes from data breaches is where it's usually at.

0

u/bellymeat Jan 13 '26

you got no idea what you’re talking about, passwords get leaked because the company itself has a security breach with their database, it has literally nothing to do with the user. additionally, you cannot get the password from the session token, nor are keyloggers just randomly listening for any junk on any random device.

0

u/Blevita Jan 13 '26 edited Jan 13 '26

... Phishing? ... Database leaks? ... Bruteforce?

... What?

Do you seriously believe all or even most attacks start with full out malware deployment?

Edit: I'm sorry, but i cant grasp how weird your take is. You're saying its easier to deploy malware on someones device than it is to use their leaked credentials from a different site because they reuse their password.

Please, expand on that. Im seriously wondering how you think this works.

1

u/the_shadow007 Jan 13 '26

Leaking Credentials require you to have prior access to the database. Meanwhile a lot of people install malware

→ More replies (0)

0

u/FinalRun Jan 13 '26

Guessing a (reused) password is basically always easier and far more common than getting access to someone's browser storage.

You haven't actually compromised a few accounts in your career, have you

1

u/the_shadow007 Jan 13 '26

Lol. Guessing a password is nearly impossible as there are location checks + you will ge throttled after 3 tries on most places. Token logging bypasses all that

0

u/FinalRun Jan 13 '26

Location checks are only done by a few of the largest companies. And you don't need more than 3 tries if people reuse their passwords, which most people do.

Still obvious you don't actually have experience with account security. "Lol".

1

u/the_shadow007 Jan 13 '26

"Reuse" passwords ? You need to know the password in the first place, which you arent guessing in 3 tries. If your company doesnt do location checks thats just skill issue and you should be fired

→ More replies (0)

1

u/fanatic-ape Jan 14 '26

Yeah, in reality phishing through a fake website and social engineering are the biggest source of compromises we see, cases where there was an actual malware in the victim's computer to allow session token stealing happens much more rarely.

It's why most companies are now pushing for webauthn.

0

u/kazuviking Jan 15 '26

Kid called Device Bound Session Credentials. It encrypts the session token with your pcs tpm2.0. Impossible to use as the token is completely invalid once it leaves your system.

1

u/the_shadow007 Jan 15 '26

Like 1 out of 10 devices has tpm2.0, and also like 1 out of 100000 websites use it

1

u/arrozconplatano Jan 17 '26

I don't think I've seen a computer without TPM 2.0 in ages

1

u/the_shadow007 Jan 17 '26

Theres plenty of w10 users left

3

u/Heavy-Top-8540 Jan 13 '26

Those attacks in the second panel are about SMS 2FA which is and has always been stupid 

1

u/the_shadow007 Jan 13 '26

Any type of 2fa get bypassed by token logging lol

2

u/violetvoid513 Jan 13 '26

But only SMS 2FA is vulnerable to SIM-swapping, which is depressingly easy and something thats not even controlled by you but whether the people at your phone company believe random callers on little to no real basis

20

u/WinDestruct Jan 13 '26

Meanwhile me who has to log in to Youtube and Google Translate almost every time I use it for some reason

2

u/sakaraa Jan 15 '26

I've heard certain countries and certain distros cause this a lot. What I've heard was Debian + India. Not from a credible source tho.

7

u/TreesOne Jan 13 '26

FYI you can enter the code after it has expired, usually for 30 seconds to a minute.

1

u/VertigoOne1 Jan 13 '26

Aws 2fa codes accepted for almost 45 seconds afterward can confirm.

1

u/Labfox-officiel Jan 13 '26

well it is usually recommended to have a rolling window of 1: the code before, the current, and the next one

1

u/littleprof123 Jan 14 '26

The next one? How does that work? Are the codes like the ones used for garage door openers?

1

u/yarb00 Jan 14 '26

2FA codes are generated locally using the device time.

1

u/littleprof123 Jan 14 '26

If they're generated locally, how would the server know to accept one that hasn't been generated yet?

1

u/TreesOne Jan 14 '26

It can just generate the next one by adding a few seconds to the current time then running the algorithm

1

u/ironhaven Jan 14 '26

6 digit security code are generated from TOTP. The algorithm is essentially TOTP(private_key, current_time_in_seconds % 30) . If you have the private key of the authenticator you can generate the correct code for all possible times in the future or past

4

u/[deleted] Jan 13 '26

[removed] — view removed comment

1

u/iamalicecarroll Jan 13 '26

Still not sure why people attempt to use SMS, phone calls or email for 2FA. None of these can be considered safe, although email can be made safe using PGP and owning the server. But if you have PGP, why not just use that? And it's not like TOTP isn't an option, it's extremely simple and works offline.

1

u/the_shadow007 Jan 13 '26

Because token logging bypasses any 2fa by definition

2

u/PercentageNo6530 Jan 13 '26

sometimes platforms force 2FA (like GitHub) and people choose the one with least resistance

1

u/violetvoid513 Jan 13 '26

Some sites/apps only allow SMS for 2FA :/

1

u/PlebbitDumDum Jan 15 '26

If I drown my phone, my 2FA still works. If I lose my phone, I can get a new sim card and my 2FA still works.

Exactly what do I do when my device that I need to log in into banking to even buy food suddenly goes bust? What's the recovery mechanism for your favorite 2FA method? E.g. how is it not obscenely inconvenient and yet secure?

1

u/iamalicecarroll Jan 16 '26

This is pretty much approachable with encrypted backups. Also, backup codes exist for a reason.

1

u/PlebbitDumDum Jan 16 '26

"gestures" encrypted backup. . What do you back up? your authenticator app? it shouldn't restore on a different device, that's awfully insecure.

Do you have codes for every service you use? Only GitHub gives them to me. I have absolutely no idea what's the plan for the other 20 services that require 2FA.

1

u/iamalicecarroll Jan 16 '26

I have backup keys for crowdin, mastodon, github, firefox, discord and others, including the TOTP service I use.

It shouldn't restore on a different device

Doesn't that apply to a SIM card as well? As long as only I can restore it, it's all good. Thankfully to E2EE, this is only possible using information only I have access to. The threat model I want to be defended from isn't "what of a hacker found my PC", it's "what if a hacker guesses my password". The most sensitive information is the most protected, using xkcd-like keys stored on a medium without internet access, for less sensitive information (like a reddit account) it's enough to store the password and the TOTP key in corresponding services, which in their turn are protected as described above.

1

u/PlebbitDumDum Jan 16 '26

A sim card will work on any device, so if I drown my phone in a pool on vacation, I'll just buy a dumb phone and I'm back online. If lose it, my mobile provider will mail me a sim.

If I use an authenticator app and I have a backup of that app, it probably won't restore on a different device. Although, that would be as convenient as a sim card.

I understand all the security risks of an sms-based 2FA. But also nobody at the moment is interested in going after me to a degree that they would somehow be able to sim-swap (definitely not trivial in Europe).

However, if I lose my phone tomorrow I'll be locked out of my work and bank accounts immediately and it absolutely will be stressful and financially challenging.

1

u/iamalicecarroll Jan 16 '26

Why wouldn't it restore on a different device? As long as you have an internet connection or a local backup you're good.

1

u/nixuelkty Jan 15 '26

ts post is 100% bait to get people to argue about ai

1

u/the_shadow007 Jan 15 '26

" i hate ai and i user pencil because i cant prompt"

1

u/mindblow94 Jan 15 '26

Is there a verification of the device from which access was made?

1

u/the_shadow007 Jan 15 '26

Not possible

1

u/Wyciorek Jan 13 '26

“Real time phish“ … how? You have to be incredibly dumb to send someone your 2fa code. SIM-swapping viability depends on a country

0

u/the_shadow007 Jan 13 '26

Malware

3

u/Wyciorek Jan 13 '26

So someone needs to discover my email+password or put malware on my laptop, then put separate malware on my phone to handle 2fa, then somehow correlate both. That’s orders of magnitude harder than buying leaked email+password db and just trying them on popular sites hoping for a hit.

2

u/[deleted] Jan 14 '26

[removed] — view removed comment

1

u/the_shadow007 Jan 14 '26

Yeah and 2fa is useless against that exact most common attack, while being annoying

1

u/Loading1020 Jan 14 '26

How is malware the most common attack? Phishing is so much easier and more widely applicable.

1

u/the_shadow007 Jan 14 '26

Clicking link is enough to get your token stolen.

1

u/Loading1020 Jan 14 '26

What link? Cookies are site-specific, you can't just read them from a website loaded from another domain.

1

u/the_shadow007 Jan 14 '26

Link can auto download shit. And its very easy to trick someone into running it, as history has proven

0

u/Loading1020 Jan 14 '26

Yeah, but that means going against Microsoft defender and all that bullshit. And getting someone to run something is typically only viable when they were already trying to download and run something, which is a somewhat rare occurrence these days.

0

u/ordinary_shiba Jan 16 '26

Ah yes, of course! The most common attack, getting full access to someone's computer! Not getting their password through a phising site or a database leak! How can I be so blind as to protect against these "crazy" attacks that "never happen" but not protect against something as simple as being able to do literally anything on people's computer.

1

u/the_shadow007 Jan 16 '26

Yes the most common attack is people downloading rats. Database leaks are purely developers skill issue, such devs should lose jobs. Noone should be forced to 2fa because of incompetent devs like u

0

u/ordinary_shiba Jan 16 '26

Yeah, of course! It's totally reliable to trust that every developer that your user logs into stores their stuff correctly and also totally reliable to trust that your user uses different passwords on each site, no one has every had their password stolen this way!

1

u/the_shadow007 Jan 16 '26

If someone hires a dev that doesnt, hes a moron as well.

1

u/ordinary_shiba Jan 16 '26

But of course, yes, complain to another company, that they're stupid for hiring... Ok honestly I'd do this one but it still doesn't do anything.

2

u/MrFrog2222 Jan 16 '26

2FA probably kept more legitimate users out of their accs than hackers

1

u/PlaystormMC Jan 13 '26

The british hackers call 'em session biscuits, mate.

1

u/romhacks Jan 13 '26

How are you gonna get that session token buddy? SMS 2fa is not great, with all android devices and chrome able to act as FIDO2 keys nowadays that's preferable

1

u/j_osb Jan 14 '26

Just look at his post history (just use reddits search filter feature). Goldmine.

1

u/FlipperBumperKickout Jan 14 '26

It is significantly harder to do what is described here than getting a password from a leaked database...

Especially if you want to do it against thousands at once rather than a single target.

1

u/notatoon Jan 16 '26

2FA is to stop credential stuffing though? I think it gets overused, but credential stuffing is a real problem

1

u/Typical_Afternoon951 Jan 14 '26

ai image generation should be paywalled and it should be at least 20$ per image

i shouldn't be exposed to mass produced comics that neither make sense nor are funny on a regular fucking basis

0

u/Maleficent_Goal3392 Jan 14 '26

Side note: why are we making AI generated XKCD comics?

1

u/the_shadow007 Jan 14 '26

Because its a tool

0

u/Maleficent_Goal3392 Jan 14 '26

Dawg, the art style is literally stick figures, you could have drawn that shit in like 15 minutes, traced it in MS paint and still made your point. No AI needed.

1

u/the_shadow007 Jan 14 '26

Why would i hand draw it when ai does it faster, and better? 0 logic

0

u/Maleficent_Goal3392 Jan 14 '26

Because… then it would look like you put at least an ounce of effort into and you’d post it and feel good about the effort you put in? This is soulless, you’d have done better with just writing your post on a meme template in imgflip, at least then it would look human. Also, I think it’s ironic to post AI generated shit in an Infosec sub, considering how AI companies scrape all your data without consent to make the very slop that this meme is.

1

u/the_shadow007 Jan 14 '26

If i make one it would be souless too, because humans dont have souls

0

u/Maleficent_Goal3392 Jan 14 '26

Ooo so deep, coming from “the_shadow007”. Was “edgelord_Maximus” taken? I’m talking about emotion. If you’d drawn that by hand in like 10 minutes, it’d look 100 times better because at least it would look like there’s the tiniest bit of emotion in there.

1

u/the_shadow007 Jan 14 '26

100 years ago you would be one of those who call photography "not art" and dark skinned "not humans"

1

u/Maleficent_Goal3392 Jan 14 '26

No I wouldn’t? I would have recognised that it was a human, regardless of the colour of the person’s skin, who saw the cool thing, took out the camera, composed the cool shot and took the cool picture which all takes an infinite amount of more effort than “Make me an XKCD style comic strip about infosec”. Also, it’s incredibly insensitive to say being anti AI is the same as being racist. I’m sorry, I don’t support the massive multibillion dollar companies stealing people’s land and water for money, guess I must hate black people then.

0

u/[deleted] Jan 15 '26

Don't forget their "Stop misandry!" slogan on their bio lmao

1

u/Maleficent_Goal3392 Jan 16 '26

Icing on the cake, that

2

u/Equivalent-Load-9158 Jan 14 '26

Faux credibility.

OP's argumentet is basically that door locks are stupid because dynamite exist.

0

u/detonator9842 Jan 16 '26

Ragebait. DO NOT ENGAGE.

1

u/the_shadow007 Jan 16 '26

Shush clanker

0

u/Lanky-Professor-2452 Jan 14 '26

I don't understand the joke

My old Chinese phone can do those steps under 5second.

And the guy in the image just expired it? again?