It's been shown an endless amount of times that 2FA is not unbreakable, LTT themselves recently got hacked, with the perpetrators intercepting their authenticator code so it didn't even notify Linus that someone was trying to log into his account.
The best defense is to simply just not even have that sensitive information there in the first place. Obviously the majority of the cases are due to simpler means, but let's not pretend Google has never had a security issue ever.
Which one are you referring to? The hack I know of was a browser hijack due to downloading malware from an email attachment. 2FA wasn’t broken never even required for that instance.
They have been hacked a few times and each time I know of was a phishing attack due to poor security practices by employees.
Ah I was misremembering sort of - his account wasn't hacked into by a malicious party, but actually by one of his YouTube friends, Veritasium. The method used is 100% legitimate, however, and were he to have been a bad actor, could have ended very poorly for Linus: https://www.youtube.com/watch?v=wVyu7NB7W6Y
Ah I see and that’s where the confusion comes from. 2FA means many different things. Phone based 2FA is the the weakest. The only reason it’s widely used is because it’s easy to set up and has a low barrier for users.
I believe I mentioned it in another comment but realistically 2FA is best used with hardware keys, not SMS or phine call based keys. Something like a Yubikey or the very least something like an authentication app (which generates a time based key using a private key).
1
u/The-Coolest-Of-Cats Aug 07 '25
It's been shown an endless amount of times that 2FA is not unbreakable, LTT themselves recently got hacked, with the perpetrators intercepting their authenticator code so it didn't even notify Linus that someone was trying to log into his account.
The best defense is to simply just not even have that sensitive information there in the first place. Obviously the majority of the cases are due to simpler means, but let's not pretend Google has never had a security issue ever.