Easily bypassed BitBucket's two-step verification

[Kamil Stepien]

I set up the two-step verification from PC 1 to use verification code given from Authy app. I used PC 2 to try to clone the private repository. I assumed I know the link to clone the repository and I obtained the password. When I entered those details through git bash, it asked me to authenticate and when I clicked on the button the browser opened with localhost:34106 which couldn't be reached as I do not have any local server running on PC 2. I came back to git bash and remote repo was at my PC 2 without any issues. This is concerning to me. Can someone explain what happened here? 

[Ana Retamal · Accepted solution]

Hi Kamil, 

I'm not sure I understand the issue completely.

You said you tried to clone the repository in PC 2, you entered your credentials and after that the repo was cloned to your computer. This sounds ok.

What I don't understand is that you were on the command line, and then you said you clicked on a button that brought you to the browser and opened localhost:34106 (You can see more here). That's Sourcetree trying to authenticate you against our servers. Do you have Sourcetree installed?

Let us know!

Ana

[Kamil Stepien]

Hi Ana, 

Yes, when I tried to clone repository the login screen for Atlassian popped up and I enter the credentials to log in. Yes, I have source tree installed and it seems to be the bug you linked, thank you.