Krzysztof kuhy Rudnicki 553c395cff inFakt is SMS-only 2FA, so the wipe cannot strand the account ... This was the last blocker on the Device Owner decision. Checked in the web panel: "Aplikacja weryfikacyjna" is unconfigured, so no TOTP seed exists for a wipe to destroy, and only "Wrazliwe" actions are gated -- "Logowanie" is unchecked, so plain login needs the password alone. The registered SMS number lives on the SIM, which survives. The browser-login approval tap is a Firebase push prompt (FirebaseInstanceIdReceiver on the device). Push tokens are per-install, so a reinstall re-registers; and if that ever misbehaved, SMS is still the fallback. Corrects the wipe checklist, which assumed TOTP secrets were "likely" inside the KeePassDX database and treated the .kdbx as a seed backup. Neither holds: the canonical .kdbx is on the PC, and there are no seeds. Earlier advice in this session to fetch inFakt backup codes was likewise for the OTP-app variant this account does not use. What still does not survive is unchanged and unrelated to 2FA: the banking pairing ("Usun powiazanie z telefonem") and the local app PIN, re-paired via SMS like mBank. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JxNrcMDcizNB3XrrYpZF23		2026-08-10 20:04:06 +02:00
..
youtube-block-unrooted.md	inFakt is SMS-only 2FA, so the wipe cannot strand the account	2026-08-10 20:04:06 +02:00