3 ms·
Surely people can still phish for the user to insert their hardware key to approve something malicious?
by alt227 1y ago
Surely people can still phish for the user to insert their hardware key to approve something malicious?
- deleted 1y ago[deleted]
- kbrkbr 1y agoWhat is phishing resistant MFA? - https://www.sans.org/blog/what-is-phishing-resistant-mfa https://www.sans.org/blog/what-is-phishing-resistant-mfa
- alt227 1y agoExactly. 'Resistant' not 'impenitrable'. The article itself says that 100% phishing resistance is impossible. So I stand by my arguement that if you give an idiot a Yubikey, it still doesnt save them from themselves. >Does this technology eliminate all risk? No. As this becomes widely deployed new attacks will be developed, but it will be MUCH harder for the cyber attacker. > FIDO is extremely resistant to phishing attacks but adopting FIDO does not mean your organization is secure against phishing.
- codedokode 1y agoHardware keys (unlike humans) usually check page URL and do not send the data stored by another domain.