4 ms·
In most cases, forcing staff to use two-factor authentication is enough to block most of attempts. Employees can still leak their passcode onc (even though stea
by miohtama 6y ago
In most cases, forcing staff to use two-factor authentication is enough to block most of attempts. Employees can still leak their passcode onc (even though stealing codes is more difficult), but there is much less risk of persistent compromise.
- ramimac 6y ago2FA is important of course, but it is in no way a panacea. Especially SMS or TOTP MFA. It is near-trivial to add a phase to phishing that captures the second factor as well. Tools like https://github.com/kgretzky/evilginx2 https://github.com/kgretzky/evilginx2 support it out-of-the-box.