4 ms·
It's not clear who this is an attack for.. organizations that have implemented phishing-resistant MFA will already have CA policy to block any sign-ins that don
by parliament32 1y ago
It's not clear who this is an attack for.. organizations that have implemented phishing-resistant MFA will already have CA policy to block any sign-ins that don't have the required authentication strength (that same "You can't get there from here" message users in unsupported browsers get). Maybe it's effective if the organization is in the middle of a rollout, where FIDO is enabled but old MFA methods haven't been disabled yet?
EDIT: This is actually called out in the article:
> The attack sequence relies on the existence of an alternative authentication method (usually MFA), besides FIDO, for the targeted user account. But luckily, this tends to be the case with FIDO implementations, as most admins prefer to maintain a practical option for account recovery.
Most orgs will have TAP for account recovery, but that's not really phishable for other reasons.
- tatersolid 1y agoBasically all other identity providers are also vulnerable to phishers which strip out webautn calls in the payload when acting as a proxy to the real IdP. Basically you must disable all other phishable forms of MFA fallback if you want phishing-resistant FIDO2/passkeys. Conditional access policies in Entra can do this selectively or org-wide. If you don’t do this you’re relying on “end user training and wariness” again as phishing protection.
- parliament32 1y agoYes, exactly. But there is little point of going through the pain and effort of rolling out phishing-resistant MFA if you're going to leave non-phishing-resistant methods available / as a fallback...
- esseph 1y agoHmmmmmmm https://taptrap.click/ https://taptrap.click/
- deleted 1y ago[deleted]