3 ms·
2FA and network security are orthogonal concerns. 2FA protects your users from silent account compromises via phishing. Network security does nothing to stop p
by javagram 5y ago
2FA and network security are orthogonal concerns.
2FA protects your users from silent account compromises via phishing. Network security does nothing to stop phishing attacks on consumer users outside your company’s firewall and email filtering.
If a company’s network actually is breached and their password database dumped, the 2FA secrets are usually in a column right next to the password hashes and don’t provide any additional security.
- quantumwannabe 5y ago2FA doesn’t protect against phishing because the phisher can just create a form for the 2FA code and the victim, who already trusts the phishing page because they’ve already typed in their username and password, will give it to them. 2FA protects against attacks like trying passwords from a hacked database on other accounts with the same username.
- RL_Quine 5y agoThe exception is U2F, which binds the key to the domain name to prevent pass through attacks.
- joshka 5y agoIt shouldn't be... This is why HSMs exist. See https://www.rfc-editor.org/rfc/rfc4226#section-7.5 https://www.rfc-editor.org/rfc/rfc4226#section-7.5 and https://www.rfc-editor.org/rfc/rfc4226#section-9 https://www.rfc-editor.org/rfc/rfc4226#section-9 for bidirectional authentication