Man in the middle attacks circumventing authenticators

Reader Comments (Page 1 of 1)

2-28-2010 @ 7:35PM

DarkWalker said...

The inputting code on the cracker's end is probably automated, so it should actually take less time than you take to simply press enter.
If they are intercepting the code as it is typed, and not as it is sent over the network, they can effectively be logging before the true owner presses enter.
Besides, the authenticator code is valid for at least 45 seconds. I've never intentionally measured it, but I can still use the previous code when the time bar for the next one is at the middle.

Add your comments

Your comments:

Remember me

E-Mail me when someone replies to this comment

Please keep your comments relevant to this blog entry. Email addresses are never displayed, but they are required to confirm your comments.

When you enter your name and email address, you'll be sent a link to confirm your comment, and a password. To leave another comment, just use that password.

To create a live link, simply type the URL (including http://) or email address and we will make it a live link for you. You can put up to 3 URLs in your comments. Line breaks and paragraphs are automatically converted — no need to use <p> or <br /> tags.