5 ms·
All the security tech in the world can't stop people from writing their passwords on sticky notes and pasting them on their monitors. Or in this case, giving th
by colinbartlett 13y ago
All the security tech in the world can't stop people from writing their passwords on sticky notes and pasting them on their monitors. Or in this case, giving them to a coworker.
Well, actually two-factor can. I wonder why a two-factor auth was not required? That would have rendered Snowden's keylogger useless.
- TheCapn 13y agoEven 2-factor is susceptible to social engineering. Years ago when I worked IT for a company the protocol for providing a 24hr bypass to their RSA token was to ask generic questions that any 'friend' could likely answer. We'd use this if they were working from home and left their token at work or the other way around.
- corin_ 13y agoThat's badly implemented 2-factor, though. If you have a system that allows you to bypass a protocol, then of course it will be easier to... bypass that protocol.
- colinbartlett 13y agoThere was that guy that outsourced his own job to a developer in China so he could surf Reddit and HN all day at work. If I recall he even FedEx'ed his two-factor auth to the guy in China so he could VPN in and complete his work.
- dublinben 13y agoI remember that guy getting caught from some OPSEC weaknesses though. He would have been better off if the Chinese replacement was logging in though a machine at the guy's house, so the IP address didn't give it away. You could also use a webcam to share the RSA token, without having to physically send it, and lose control of it.
- omh 13y agoThis was a form of two-factor authentication. There was a certificate and a password and Snowden apparently obtained both. There are obviously other types of 2FA that would have prevented this, but it's interesting to note that this qualify as two-factor for many companies.