Quote from: hatshepsut93 on February 01, 2019, 02:08:43 PM

Quote from: figmentofmyass on February 01, 2019, 06:33:30 AM

sorry if this is a dumb question, but how exactly does this compromise 2FA?

all of the compromised data is browser-based (something you know, not something you have), with the exception of "stolen text messages". but old text messages shouldn't overcome SMS 2-factor authentication because those one-time codes are only good for a very limited time. and if you use TOTP-based 2FA, you should be completely safe.

can somebody walk me through this?

If found another article , and it says that stolen cookies can be used to fake the identity of victim's machine, and thus login without a 2FA check on some sites. However, there are still a lot of unexplained details, like how they avoid 2FA checks on withdrawals, how do they spoof IP address and so on.

It's an interesting topic and people who have very important online accounts, like traders, should definitely check it, so here's some links:

https://security.stackexchange.com/questions/178663/why-isnt-stealing-cookies-enough-to-authenticate

https://stackoverflow.com/questions/2498599/can-some-hacker-steal-the-cookie-from-a-user-and-login-with-that-name-on-a-web-s

thanks for the explanation. i think i get it now. it didn't occur to me that hackers were duplicating an existing session using the stolen cookies. it's still not an easy attack to pull off since the attacker needs to spoof the IP address (and other parameters) from the original session, but it's good to be aware that this can happen. it definitely makes a strong case for requiring 2FA on withdrawals (email confirmation and TOTP) in case your session gets hijacked like this.