reposting my claim of first repro of a 2fa bypass.

I had deleted my first claim, because when I tested it again it didn't work. I flushed the browser and it did work again, so some residual state gets left after login that needs to be cleared to make it work again.

​

I had no communication with u/illamaste-to-you on this, and it is likely not the same mechanism. I don't use ATP, either.

I don't want to drop hints. But this is all about entry points, and knowing where you want to go.

It's pretty brain dead easy. I think it reflects the overall looseness of engineering around the retail products at fidelity.

u/illamaste is correct that anyone using sms text-based 2fa should assume it's easily bypassed.

I used only my username and login, and was able to get to my positions page and place a trade. Therefore I'm confident I'm fully "logged in" from the Fidelity point of view.

I had previously tested that my enabled 2fa really worked. It did, I could only login with the text code. I actually got blocked by their bot/security detection with the standard "system error, try again later" message and switched to another browser which still worked fine.

I literally only tried 2 or 3 ideas before I found a way in (without sms 2fa, just username/pass)