Login portal bypasses 2FA

[Joe95]

Hi,

I've just discovered something quite concerning when logging into my btinternet email. When using this page from the BT website: https://prod-btemailauth.bt.com/81522fe7-47cf-4713-bdb7-b6f7bfe421a6/b2c_1a_rpbt_signin/oauth2/v2.0/...

This appears to completely bypass 2FA. I've tried it on various browsers and networks. Does anyone else experience this?

[barnpiece]

I had to use 2FA every time, but in the last week or so it has allowed me in without needing a code.

I think that they've changed things now so that it will let you in once it 'knows' you.

I use https://www.bt.com/email to access webmail.

Richard

[shakey1981]

use thunderbird Microsoft store

email settimgs  of course you will need to know your passwordhttps://www.bt.com/help/email/manage-email-account/manual-settings/what-are-the-settings-for-outgoin...

[Joe95]

---

I currently use Apple Mail and that’s fine. I just meant the web portal seems to completely bypass 2FA which is concerning. 

[Joe95]

Yeah it bypasses 2FA for this link also. It seems to be specifically localised to email. Logging into myBT triggers 2FA every time. The email login not triggering it bit concerning if your password is compromised.

[WSH]

I’m not sure how BT are doing it, but usually in situations like this, the connecting machine is recognised via something like its MAC address after the first time it connects.

For example, my credit card provider’s site asks if I want to “trust this device” the first time I connect and pass 2FA.  Subsequently, it does not use 2FA again for that device.

You will probably find that if you try to access via another machine 2FA will be invoked again.  Someone would need your password and that particular machine to get in.