Fine, I'll bite... 1. Password reset If your password reset allows bypassing MFA you have a state problem. 2. Social Engineering Yea, that's a people proble

Fine, I'll bite... 1. Password reset If your password reset allows bypassing MFA you have a state problem. 2. Social Engineering Yea, that's a people problem. Train your people to be vigilant. 3. Man-in-the-middle Attacks Are always a problem when you are working with something the other side knows, SMS, TOTP, email codes etc. 4. OAuth Consent phishing See 2. Also, don't use Google as your Authentication provider. Use Okta / Keycloak / whatever, to make sure you control which applications are allowed to interact with systems based on a user you authenticated. 5. Duplicate-Generator This goes back to 3. If you are able to intercept anything, you're hosed. And the TOTP problem with the static seed codes is a well-known problem. 6. SIM-Jacking So back to SMS and Man-in-the-middle Attacks. Don't use SMS, use eSIMs, notify your account manager that no overrides are allowed. But reading this ^ feels like problems on multiple layers. And using a third party authentication system isn't gonna solve the MiTM and SMS problem if you keep on using SMS factors. Even if I use FIDO2 an MiTM attack is gonna get through...