<story><title>I abused 2FA to maintain persistence after a password change</title><url>https://medium.com/@lukeberner/7e3f455b71a1</url></story><parent_chain></parent_chain><comment><author>elcomet</author><text>I think this attack is slightly overrated by the other commenters (and those that say it defeats 2FA are wrong).&lt;p&gt;Here is the scenario he posted:&lt;p&gt;&lt;pre&gt;&lt;code&gt;  &amp;gt; An Attacker enables 2FA in Victim’s account.
  &amp;gt; In another browser, Attacker waits indefinitely in the 2FA input page (Image 1).
  &amp;gt; Attacker disables 2FA.
  &amp;gt; The Victim regains access to the account (changing password &amp;amp; resetting sessions)
  &amp;gt; Then the Attacker could input a valid 2FA code and have access again to the account, without knowing the current password.
&lt;/code&gt;&lt;/pre&gt;
So to summarize:&lt;p&gt;- The attacker needs the password of an account that is &lt;i&gt;not protected by 2FA&lt;/i&gt;.&lt;p&gt;- It allows the attacker to stay connected after a password change (usually, when a password change occurs, it logs out the user of all platforms).&lt;p&gt;In fact, 2FA protects you from this vulnerability : just activate it for your account and you are not vulnerable to this attack (the attacker cannot connect to your account in the first place, since he doesn&amp;#x27;t control 2FA tokens).&lt;p&gt;Moreover, if your account doesn&amp;#x27;t have 2FA and someone finds out your password, well I think you are already deep in trouble (the attacker could do many more things, since he&amp;#x27;s already connected).&lt;p&gt;So this attack is still a big deal (the user can&amp;#x27;t disconnect you) but it doesn&amp;#x27;t break 2FA security at all. It just adds a vulnerability to accounts that don&amp;#x27;t have 2FA enabled.</text></comment>
<story><title>I abused 2FA to maintain persistence after a password change</title><url>https://medium.com/@lukeberner/7e3f455b71a1</url></story><parent_chain></parent_chain><comment><author>donalhunt</author><text>Instagram: &amp;quot;[the attack] seems unlikely to happen commonly, making this more of a theoretical attack. The protection in this case is to not allow someone to steal your password&amp;quot;&lt;p&gt;LOL&lt;p&gt;Isn&amp;#x27;t the whole point of MFA to protect the theft of the one of the authentication tokens? and the password is the most likely to be stolen &amp;#x2F; compromised imho.</text></comment>