Take the 2-minute tour ×
Web Applications Stack Exchange is a question and answer site for power users of web applications. It's 100% free, no registration required.

I have 2-step authentication turned on for my Outlook.com account and I generate app passwords to access the services on certain devices. I am wondering about possibility of hacking my account with app password.
Imagine this situation for example. Say I accidentally download a malicious application on my mobile device which asks me to log in with Outlook.com account. So, I generate an app password on my PC and provide it to this application. But this malicious software sends my username and password(which will be app password) to a hacker in background.

In this scenario, can the hacker gain total control of my account?
If not total control, what would he/she be able to do with app password?

I have mentioned Outlook.com in my question but its very much applicable to other services such as Gmail etc.

share|improve this question
    
This might be a better question for Information Security. –  Al E. Mar 21 at 14:44
    
I was not sure. May be you can flag it for migration and let the mods decide, –  tumchaaditya Mar 21 at 19:47

2 Answers 2

The hacker will gain as much control as the APP password provides (read: what you can do with the key, the hacker will be able to do).

share|improve this answer

What you described is a Man-In-The-Middle Attack On 2FA.

Basically, it means that in the case you described, the attacker would have access to whatever information the 2FA was protecting. If that means your whole Outlook/Anything else account, then that's what the attacker would get access to.

More info on how the attack would be: http://www.pulsesecure.com/articles/web_2fa.html

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.