5 ms·

In this and age, if companies are not giving employees FIDO2 security keys it's just incompetence.

by nabla9 5y ago

arkadiyt 5y ago
The account didn't have any kind of 2fa - even SMS would have stopped this breach. Obviously hardware keys are the gold standard but I wouldn't trivialize the amount of work it takes to roll that out to an organization.
- Godel_unicode 5y ago
  I would, it's pretty trivial (I have done it for multiple organizations of different sizes/technical competencies). Especially for something like a VPN; at this point if you use a VPN solution which doesn't support MFA it almost certainly has other security issues as well.
- ineedasername 5y ago
  I have a family member who had a very junior role at a big finance company 15 years ago and they used hardware keys. Seems like national infrastructure should require similar levels of security.
- qbasic_forever 5y ago
  For any sysadmins or future sysadmins reading this though, do NOT put your service's 2FA on SMS. Do not use SMS for anything other than sending your grandparents a happy birthday message. It is trivially broken with a sim card hijack and we have seen many high profile incidents of people being hacked precisely through this vector.
  - rossdavidh 5y ago
    ...and yet, it would have been better than this setup.
- kevin_thibedeau 5y ago
  These days cheapskate companies will insist on a validator app on employee provided phone rather than take the hit on capital expenditure for a proper key. It would be nice to have legislation that bans that practice.
  - bimboler38 5y ago
    I think legislators will start setting how important it is to protect infrastructure and implement something similar to PCI/DSS.
contravariant 5y ago
For most things regular any kind of MFA is good enough. Even just a password can be acceptable if it's not too important. For stuff that ends up in international newspapers you definitely want more than that though.
altdataseller 5y ago
Doesn’t Okta solve this problem?

In this and age, if companies are not giving employees FIDO2 security keys it's just incompetence.

by nabla9 5y ago

In this and age, if companies are not giving employees FIDO2 security keys it's just incompetence.

The account didn't have any kind of 2fa - even SMS would have stopped this breach. Obviously hardware keys are the gold standard but I wouldn't trivialize the amount of work it takes to roll that out to an organization.

Godel_unicode 5y ago
I would, it's pretty trivial (I have done it for multiple organizations of different sizes/technical competencies). Especially for something like a VPN; at this point if you use a VPN solution which doesn't support MFA it almost certainly has other security issues as well.
ineedasername 5y ago
I have a family member who had a very junior role at a big finance company 15 years ago and they used hardware keys. Seems like national infrastructure should require similar levels of security.
qbasic_forever 5y ago
For any sysadmins or future sysadmins reading this though, do NOT put your service's 2FA on SMS. Do not use SMS for anything other than sending your grandparents a happy birthday message. It is trivially broken with a sim card hijack and we have seen many high profile incidents of people being hacked precisely through this vector.
- rossdavidh 5y ago
  ...and yet, it would have been better than this setup.
kevin_thibedeau 5y ago
These days cheapskate companies will insist on a validator app on employee provided phone rather than take the hit on capital expenditure for a proper key. It would be nice to have legislation that bans that practice.
- bimboler38 5y ago
  I think legislators will start setting how important it is to protect infrastructure and implement something similar to PCI/DSS.

contravariant 5y ago

For most things regular any kind of MFA is good enough. Even just a password can be acceptable if it's not too important. For stuff that ends up in international newspapers you definitely want more than that though.

altdataseller 5y ago

Doesn’t Okta solve this problem?