Hacker News new | ask | show | jobs
by gideon_b 3130 days ago
Two factor won't protect you from a spear-fishing attack.

The attacker can submit your info to GitHub the moment you submit to the malicious site. You receive the token via SMS as expected, enter it on the second page of the malicious site, granting them access.