[Lrrr]

While messing around with my account I found it was possible to disable 2fa by simply clicking the reset button while logged in (https://hackforums.net/gauth.php?action=...st_key=***)

This could theoretically be used to send a user to a link that disables their 2fa (if you knew their my_post_key).

Also, if I didn't clear the cookies on my browser, and my computer was stolen they could turn off my 2fa.

I think RESETS should be required to be done by an admin, or require the user to input a valid 2fa code to disable the feature.

[minimalist]

I suggested this here:
https://hackforums.net/showthread.php?tid=5209610

but Omniscient didn't want it, if memory serves correctly...don't want to read over the messages.

Also, the post key doesn't grant users access to anything unless said users are on said other user's account. Don't give it away though.

[Neeeeeeeeeel.-]

I agree with this request, but it will also load Omni with disabling 2FA & repkilling more members because they'd lost their keys.

[LordCoder]

When my iPhone was stolen, the only way to switch 2FA was by doing this. Otherwise I'd have had a big problem.

[Neeeeeeeeeel.-]

When my iPhone was stolen, the only way to switch 2FA was by doing this. Otherwise I'd have had a big problem.

If you use "Authy" you can always recover your auth tokens with the master password. I don't know if it's available for iOS but I think it is.

[ElDoc]

Build the wall Omni, close this down.

[Bαker]

If you use "Authy" you can always recover your auth tokens with the master password. I don't know if it's available for iOS but I think it is.

Yes it is on iOS I've been using it for years

[Neeeeeeeeeel.-]

This^

---

I know Authy saves everything to your account.
But that kind of defeats the purpose of having that extra layer.
Otherwise it's just 2 passwords, and I'm sure some baboon used the same password for both accounts.

You are right, it's indeed 2 password instead of real 2FA. But I prefer 2 passwords than a repkill if I lost my 2FA device.

[Deathmask]

Wow, this seems like a pretty major bug, hope Omni fixes it.

[Vitani]

I actually think it's a good thing you can reset it like this.
As the user above said, if you ever lose your phone and are stupid enough not to have any backup, then this is your best bet.

[Lrrr]

I actually think it's a good thing you can reset it like this.
As the user above said, if you ever lose your phone and are stupid enough not to have any backup, then this is your best bet.

but that seems like you're trying to justify a bug based on a test-case that is flawed to begin with.

I mean I get it, it makes sense and is helpful in that scenario...but should you actually be in that scenario to begin with?

[Vitani]

but that seems like you're trying to justify a bug based on a test-case that is flawed to begin with.

I mean I get it, it makes sense and is helpful in that scenario...but should you actually be in that scenario to begin with?

You're right, honestly people should not even have to use this as last resort, as a simple backup would be sufficient.

This could potentially be exploited if someone got infected and the person behind it wants to steal their HF account. Maybe it has already been exploited.

[Lrrr]

This could potentially be exploited if someone got infected and the person behind it wants to steal their HF account. Maybe it has already been exploited.

One of the reasons I made this thread is that I believe this is how Regulus was compromised.

[Vitani]

One of the reasons I made this thread is that I believe this is how Regulus was compromised.

Hmm could be.

It buggs the f*ck outta me that Regulus still hasn't tried to get his account back.
It's not like him.

[05317832892]

I suggested this here:
https://hackforums.net/showthread.php?tid=5209610

but Omniscient didn't want it, if memory serves correctly...don't want to read over the messages.

Also, the post key doesn't grant users access to anything unless said users are on said other user's account. Don't give it away though.

Not quite what I think he was getting at. The vulnerability here is if you know someone's post key you could send them a shortened link to it. Should they go through the effort of checking what's behind it, they may even fail to realize that it's an "unsafe" hf link.

Hypothetically if this was going to happen you would need to know their password, post key, and bait them into clicking the link. In reality this would never happen unless someone accidentally gave out their code.

Tbh the only way I can see this going wrong is if someone makes a YouTube video and they brush over a link that reveals their code. Even then some browsers may trauncate the link when it's previewed.


This is all just speculation. I'm my opinion I don't think it's a massive flaw. The best idea in my opinion is just to make it a JavaScript button or something that can't be linked.

Making omni or someone else manually approve 2FA disables is very lengthy and time wasting. Systems like this should probably be automated.

Edit: Vitani has just made a very good point. Part of 2FA in my opinion is that if your computer is compromised they don't have access to you account. Most rats or botnets have a visit link function, running this through that would force them to open the link disabling their 2FA. At the same time if you ARE ratted then they may be able to manipulate your cookies/reverse proxy and open your HF account regardless.