2026-10-14 07:58 UTC
Replies (3)
-
@tuhriel@discuss.tchncs.de 2026-10-14 08:16
Call them, say you are the bank and they have seen fraudulent transactions, and to restore the account they will send you a code which you have to tell them… For the sms codes: it’s also pretty easy to copy/clone a sim There is also the option of a MITM attack with a portal that forwards the login to the real login page and then cuts your connection and the MITM has the open session. The good thing with passkeys is, there is nothing a fraudster can get from a user. You can’t forward your passkey via the phone, and MITM are much, much harder to pull off
-
@flamingo_pinyata@sopuli.xyz 2026-10-14 08:20
Fairly easily if you create a good replica of the original website the user is trying to log in to. In a lot of cases, even technically savvy people are not going to verify the URL.
-
@slazer2au@lemmy.world 2026-10-14 09:55
Evilnginx has existed for almost a decade to get otop codes.