Hacker News
A complete bypass of eMudhra’s 1FA OTP login system
SecurityFirst seen 108 points24 comments
A security researcher says they found a way to get past the login system used by eMudhra, an Indian digital security company. The method skips the one-time password (OTP) step. The article text here is very garbled, so the details are hard to confirm.
What happened
A report describes a full bypass of eMudhra's 1FA OTP login system. In plain words, this means someone may be able to log in without passing the code check that is meant to protect the account. The text we received is mostly broken and unrelated words, so we cannot confirm how the bypass works or who found it.
Some background
Many websites and services use a one-time password (OTP). This is a short code sent to your phone or app that works only once. It adds a second check to your login. The label 1FA means one factor of authentication, which usually means only one check, such as a password, is used. A bypass is a way to get around a security check.
Why it matters
Login systems protect private accounts and sensitive data. If a bypass works, attackers could enter accounts they should not reach. Companies usually fix such problems quickly, and users should watch for official notices.
What to watch
- Whether eMudhra confirms the bypass and releases a fix
- Details from the original report, such as how the bypass works
- Advice for customers who use eMudhra login systems
- Any reports of misuse of affected accounts
Glossary
- eMudhra
- An Indian company that makes digital security and digital signature tools.
- OTP
- One-time password: a short code that works only once, used to confirm a login.
- 1FA
- One-factor authentication: a login that uses only one type of check.