
== 2FA Password Reset

An excellent example of authentication bypass is a recent (2016) example (https://henryhoggard.co.uk/blog/Paypal-2FA-Bypass). He could not receive an SMS with a code, so he opted for
an alternative method, which involved security questions.  Using a proxy, removed the parameters entirely and won.

image::images/paypal-2fa-bypass.png[Paypal 2FA bypass,1397,645,style="lesson-image"]


=== The Scenario

You reset your password, but do it from a location or device that your provider does not recognize. So you need to answer the security questions you set up.  The other issue is
Those security questions are also stored on another device (not with you), and you don't remember them.

You have already provided your username/email and opted for the alternative verification method.
