When MFA isn't MFA, or how we got phished
1–10 of 287 posts
Re: When MFA isn't MFA, or how we got phished
#2>The caller claimed to be one of the members of the IT team, and deepfaked our employee’s actual voice. The voice was familiar with the floor plan of the office, coworkers, and internal processes of the company.
Wow that is quite sophisticated.
Re: When MFA isn't MFA, or how we got phished
#3>The caller claimed to be one of the members of the IT team, and deepfaked our employee’s actual voice. The voice was familiar with the floor plan of the office, coworkers, and internal processes of the company. Wow that is quite sophisticated.
inside job?
Re: When MFA isn't MFA, or how we got phished
#4Naming/training issue imo.
We need a better name than MFA.
Something like “personal password like token that should only be entered into secure computer on specific website/app/field and never needed to be shared”
Re: When MFA isn't MFA, or how we got phished
#5Naming/training issue imo. We need a better name than MFA. Something like “personal password like token that should only be entered into secure computer on specific website/app/field and never needed to be shared”
It's well known that OTP is not immune to phishing. Force your users on webauthn or some other public key based second factor if you're aiming at decreasing the incident rate.
Re: When MFA isn't MFA, or how we got phished
#6I don't understand: Why on earth does google want to sync MFA tokens? They're one-time use, aren't they? Or... feh, I can't even fathom
Re: When MFA isn't MFA, or how we got phished
#7>The caller claimed to be one of the members of the IT team, and deepfaked our employee’s actual voice. The voice was familiar with the floor plan of the office, coworkers, and internal processes of the company. Wow that is quite sophisticated.
inside job?
how's that Zero Trust architecture working out for everyone ?
Re: When MFA isn't MFA, or how we got phished
#8I don't understand: Why on earth does google want to sync MFA tokens? They're one-time use, aren't they? Or... feh, I can't even fathom
They mean they are syncing the private key used to generate the tokens on demand.
Re: When MFA isn't MFA, or how we got phished
#9I don't understand: Why on earth does google want to sync MFA tokens? They're one-time use, aren't they? Or... feh, I can't even fathom
Answering myself, this helps a bit: https://www.zdnet.com/article/google-authenticator-will-now-...
I guess we need a better way to handle "Old phone went swimming, had to buy another, now what?"
Re: When MFA isn't MFA, or how we got phished
#10I don't understand: Why on earth does google want to sync MFA tokens? They're one-time use, aren't they? Or... feh, I can't even fathom
Syncing of "MFA codes" is really syncing of the secret component of TOTP (time based one time password).
And it's a good thing, and damn any 2fa solution that blocks it. I don't want to go through onerous, incompetent, poorly designed account recovery procedures if a toddler smashes my phone. So I use authy personally, while a friend backs his up locally.