3 ms·
Good job describing the breakin to the laptop, but I was disappointed when I read that after bootup it auto-connects to the corporate network, nothing like Okta
by not2b 5y ago
Good job describing the breakin to the laptop, but I was disappointed when I read that after bootup it auto-connects to the corporate network, nothing like Okta or Yubikey or something else needed as an authentication step. That made things too easy and seems like bad security practice.
- mabbo 5y agoPin + Yubikey. Not certain whether you can use a Yubikey without a pin, but I think it's important to specify: something you have plus something you know. The reason: the newer yubikeys don't ever leave the usb port. Mine is almost impossible to remove. And if this attack is based on a stolen laptop then chances are the yubikey comes with it. https://www.amazon.com/dp/B07HBDX2CM https://www.amazon.com/dp/B07HBDX2CM
- vitus 5y agoThe standard trick that I've seen used for removing a Yubikey Nano is threading a paperclip through that little hole, and tugging. Incidentally, you can also use a paperclip (a chain, even) to trigger a touch without having to touch the key directly.
- yencabulator 5y ago> Not certain whether you can use a Yubikey without a pin You can choose, no pin / pin once after plugging in / pin on every use.
- krzyk 5y agoYubikey is not something popular in enterprises. At least not the ones I worked for. I only heard about it because Google uses it (or something similar).
- deepfriedrice 5y agoAmazon uses it
- not2b 5y agoMy company uses Okta Verify. So when the bad guy tries to connect the hacked laptop to the corporate network VPN, the person who was assigned that laptop gets a "Login attempt, is that you?" message on their cell phone (if the push method is used) or is prompted for the 6-digit code, and it doesn't connect until confirmation is received. Unless someone can defeat it somehow.