3 ms·

Using MFA is absolutely a must. But not using hardware based 2FA doesn't make the IT department, completely negligent or incompetent. Most companies I know if

Using MFA is absolutely a must. But not using hardware based 2FA doesn't make the IT department, completely negligent or incompetent. Most companies I know if they are using MFA are using Microsoft Authenticator soft tokens through their enterprise 365 environments.

remram 4y ago
MFA is extremely vulnerable to fishing, ie. man-in-the-middle. It is pretty useless, hardware token or not. U2F/webauthn mostly fixes that.
sneak 4y ago
The Reddit hack in question phished the user-input MFA (presumably TOTP) string.
- NoPicklez 4y ago
  My point being is that by not having hardware based MFA, but still have a form of soft token MFA doesn't make the IT personnel completely incompetent or negligent. Not requiring MFA at all and having weak passwords would be an example of that.
  - sneak 4y ago
    Then why are they still getting owned via common/routine phishing attacks? Ones that are entirely, cheaply, and easily preventable?
    - iinnPP 4y ago
      Because they don't pay a competent person to do their security or because the person they paid isn't able/willing to make decisions. Phishing is not obviously sophisticated but an argument could be made. The problem with letting that kind of language slide is that it skirts responsibility. Society has a huge accountability problem currently and there isn't really an end in sight. There's no need to continue allowing corporations to use such language and continuing the problem. If a solution to phishing is available and not used, the easy mode hack is attributed to the security of the people so responsible. They took a risk and that went bad. Fire them(the people ACTUALLY RESPONSIBLE) and move forward with a better model of security. The person actually responsible is the person(s) who made the final call on using security susceptible to phishing attacks where a better option exists.

remram 4y ago

MFA is extremely vulnerable to fishing, ie. man-in-the-middle. It is pretty useless, hardware token or not. U2F/webauthn mostly fixes that.

sneak 4y ago

The Reddit hack in question phished the user-input MFA (presumably TOTP) string.

NoPicklez 4y ago
My point being is that by not having hardware based MFA, but still have a form of soft token MFA doesn't make the IT personnel completely incompetent or negligent. Not requiring MFA at all and having weak passwords would be an example of that.
- sneak 4y ago
  Then why are they still getting owned via common/routine phishing attacks? Ones that are entirely, cheaply, and easily preventable?
  - iinnPP 4y ago
    Because they don't pay a competent person to do their security or because the person they paid isn't able/willing to make decisions. Phishing is not obviously sophisticated but an argument could be made. The problem with letting that kind of language slide is that it skirts responsibility. Society has a huge accountability problem currently and there isn't really an end in sight. There's no need to continue allowing corporations to use such language and continuing the problem. If a solution to phishing is available and not used, the easy mode hack is attributed to the security of the people so responsible. They took a risk and that went bad. Fire them(the people ACTUALLY RESPONSIBLE) and move forward with a better model of security. The person actually responsible is the person(s) who made the final call on using security susceptible to phishing attacks where a better option exists.