Weena wrote:
That's exactly how it works.
The number works for a longer duration than a second though.
The viruses that targetted the authenticators didn't actually target the authenticators, they'd just bullshit the part that asked for the number.
You'd type it in, thinking it was the game, but then that number would siphon off to whoever and it would tell you it didn't match (which you know isn't uncommon if you've used one).
They'd enter it legitimately and pluck off whatever while you sat there going ... wat?
Similar thing has been done to Steam login. People were getting fake log in windows.
Right but that seems like a logic flaw to me.
If the salt/hash is down to the second, then even if they took you to an false login screen, the only useful information they would get from you is the email and password.
If they received your number: 123456 (my luggage combo)
Then in the transmission time + latency, there is only a small chance they would be able to turn that around in the next 500 milliseconds to log in. Of course that would be beneficial but only one time.
A smarter play would be to collect a large database of auth codes which are timestamped when collected. Then the parameters for the encryption can be gleened from that.
The only problem here is if someone were to submit an incorrect value from their authenticator, you have ruined your solution set and would have to start over. Since you would have no way to verify if the code was valid.
This is just me overthinking the problem I am sure.
TL;DR
The amount of time it would take to actually replicate your authenticator process, far outweighs the value of your account.
