Mastodon

Erik van Straten"Franse overheid voert phishingtest uit op 2,5 miljoen leerlingen" <a href="https://www.security.nl/posting/881630/Franse+overheid+voert+phishingtest+uit+op+2%2C5+miljoen+leerlingen" rel="nofollow noopener" translate="no" target="_blank">https://www.security.nl/posting/881630/Franse+overheid+voert+phishingtest+uit+op+2%2C5+miljoen+leerlingen</a>KRANKZINNIG!Het is meestal onmogelijk om nepberichten (e-mail, SMS, ChatApp, social media en papieren post - zie plaatje) betrouwbaar van echte te kunnen onderscheiden.Tegen phishing en vooral nepwebsites is echter prima iets te doen, zoals ik vandaag nogmaals beschreef in <a href="https://security.nl/posting/881655" rel="nofollow noopener" translate="no" target="_blank">https://security.nl/posting/881655</a>.(Big Tech en luie websitebeheerders willen dat niet, dus is en blijft het een enorm gevecht).<a href="https://infosec.exchange/tags/Phishing" class="mention hashtag" rel="nofollow noopener" target="_blank">#Phishing</a> <a href="https://infosec.exchange/tags/NepWebsites" class="mention hashtag" rel="nofollow noopener" target="_blank">#NepWebsites</a> <a href="https://infosec.exchange/tags/DV" class="mention hashtag" rel="nofollow noopener" target="_blank">#DV</a> <a href="https://infosec.exchange/tags/DVcerts" class="mention hashtag" rel="nofollow noopener" target="_blank">#DVcerts</a> <a href="https://infosec.exchange/tags/LetsEncrypt" class="mention hashtag" rel="nofollow noopener" target="_blank">#LetsEncrypt</a> <a href="https://infosec.exchange/tags/Certificates" class="mention hashtag" rel="nofollow noopener" target="_blank">#Certificates</a> <a href="https://infosec.exchange/tags/Certificaten" class="mention hashtag" rel="nofollow noopener" target="_blank">#Certificaten</a> <a href="https://infosec.exchange/tags/Spoofing" class="mention hashtag" rel="nofollow noopener" target="_blank">#Spoofing</a> <a href="https://infosec.exchange/tags/AitM" class="mention hashtag" rel="nofollow noopener" target="_blank">#AitM</a> <a href="https://infosec.exchange/tags/MitM" class="mention hashtag" rel="nofollow noopener" target="_blank">#MitM</a> <a href="https://infosec.exchange/tags/Evilginx2" class="mention hashtag" rel="nofollow noopener" target="_blank">#Evilginx2</a> <a href="https://infosec.exchange/tags/Zwakke2FA" class="mention hashtag" rel="nofollow noopener" target="_blank">#Zwakke2FA</a> <a href="https://infosec.exchange/tags/ZwakkeMFA" class="mention hashtag" rel="nofollow noopener" target="_blank">#ZwakkeMFA</a> <a href="https://infosec.exchange/tags/Weak2FA" class="mention hashtag" rel="nofollow noopener" target="_blank">#Weak2FA</a> <a href="https://infosec.exchange/tags/WeakMFA" class="mention hashtag" rel="nofollow noopener" target="_blank">#WeakMFA</a> <a href="https://infosec.exchange/tags/Authenticatie" class="mention hashtag" rel="nofollow noopener" target="_blank">#Authenticatie</a> <a href="https://infosec.exchange/tags/Impersonatie" class="mention hashtag" rel="nofollow noopener" target="_blank">#Impersonatie</a> <a href="https://infosec.exchange/tags/Authentication" class="mention hashtag" rel="nofollow noopener" target="_blank">#Authentication</a> <a href="https://infosec.exchange/tags/Impersonation" class="mention hashtag" rel="nofollow noopener" target="_blank">#Impersonation</a> <a href="https://infosec.exchange/tags/DomainNames" class="mention hashtag" rel="nofollow noopener" target="_blank">#DomainNames</a> <a href="https://infosec.exchange/tags/Authenticity" class="mention hashtag" rel="nofollow noopener" target="_blank">#Authenticity</a> <a href="https://infosec.exchange/tags/Aurhenticiteit" class="mention hashtag" rel="nofollow noopener" target="_blank">#Aurhenticiteit</a> <a href="https://infosec.exchange/tags/Owner" class="mention hashtag" rel="nofollow noopener" target="_blank">#Owner</a> <a href="https://infosec.exchange/tags/Eigenaar" class="mention hashtag" rel="nofollow noopener" target="_blank">#Eigenaar</a> <a href="https://infosec.exchange/tags/Verantwoordelijke" class="mention hashtag" rel="nofollow noopener" target="_blank">#Verantwoordelijke</a> <a href="https://infosec.exchange/tags/Responsible" class="mention hashtag" rel="nofollow noopener" target="_blank">#Responsible</a> <a href="https://infosec.exchange/tags/Accountable" class="mention hashtag" rel="nofollow noopener" target="_blank">#Accountable</a> <a href="https://infosec.exchange/tags/DigiD" class="mention hashtag" rel="nofollow noopener" target="_blank">#DigiD</a> <a href="https://infosec.exchange/tags/SMS" class="mention hashtag" rel="nofollow noopener" target="_blank">#SMS</a> <a href="https://infosec.exchange/tags/Email" class="mention hashtag" rel="nofollow noopener" target="_blank">#Email</a> <a href="https://infosec.exchange/tags/ChatApps" class="mention hashtag" rel="nofollow noopener" target="_blank">#ChatApps</a> <a href="https://infosec.exchange/tags/Verzender" class="mention hashtag" rel="nofollow noopener" target="_blank">#Verzender</a> <a href="https://infosec.exchange/tags/Sender" class="mention hashtag" rel="nofollow noopener" target="_blank">#Sender</a> <a href="https://infosec.exchange/tags/BigTechIsEvil" class="mention hashtag" rel="nofollow noopener" target="_blank">#BigTechIsEvil</a> <a href="https://infosec.exchange/tags/GoogleIsEvil" class="mention hashtag" rel="nofollow noopener" target="_blank">#GoogleIsEvil</a> <a href="https://infosec.exchange/tags/CloudflareIsEvil" class="mention hashtag" rel="nofollow noopener" target="_blank">#CloudflareIsEvil</a>

Erik van Straten<a href="https://mastodon.social/@BjornW" class="u-url mention" rel="nofollow noopener" target="_blank">@BjornW</a> :I've stopped doing that after a lot of people called me an idiot and a liar if I kindly notified them. I stopped, I'll get scolded anyway.Big tech and most admins want everyone to believe that "Let's Encrypt" is the only goal. Nearly 100% of tech people believe that.And admins WANT to believe that, because reliable authentication of website owners is a PITA. They just love ACME and tell their website visitors to GFY.People like you tooting nonsense get a lot of boosts. It's called fake news or big tech propaganda. If you know better, why don't you WRITE BETTER?It has ruined the internet. Not for phun but purely for profit. And it is what ruins people's lives and lets employees open the vdoor for ransomware and data-theft.See also <a href="https://infosec.exchange/@ErikvanStraten/112914047006977222" rel="nofollow noopener" translate="no" target="_blank">https://infosec.exchange/@ErikvanStraten/112914047006977222</a> (and, in Dutch, <a href="https://security.nl/posting/881296" rel="nofollow noopener" translate="no" target="_blank">https://security.nl/posting/881296</a>).<a href="https://infosec.exchange/@troyhunt" class="u-url mention" rel="nofollow noopener" target="_blank">@troyhunt</a> <a href="https://infosec.exchange/@letsencrypt" class="u-url mention" rel="nofollow noopener" target="_blank">@letsencrypt</a> <a href="https://infosec.exchange/tags/DV" class="mention hashtag" rel="nofollow noopener" target="_blank">#DV</a> <a href="https://infosec.exchange/tags/Impersonation" class="mention hashtag" rel="nofollow noopener" target="_blank">#Impersonation</a> <a href="https://infosec.exchange/tags/AnonymousCertificates" class="mention hashtag" rel="nofollow noopener" target="_blank">#AnonymousCertificates</a> <a href="https://infosec.exchange/tags/Authentication" class="mention hashtag" rel="nofollow noopener" target="_blank">#Authentication</a> <a href="https://infosec.exchange/tags/LetsAuthenticate" class="mention hashtag" rel="nofollow noopener" target="_blank">#LetsAuthenticate</a> <a href="https://infosec.exchange/tags/BigTechIsEvil" class="mention hashtag" rel="nofollow noopener" target="_blank">#BigTechIsEvil</a> <a href="https://infosec.exchange/tags/GoogleIsEvil" class="mention hashtag" rel="nofollow noopener" target="_blank">#GoogleIsEvil</a> <a href="https://infosec.exchange/tags/CloudflareIsEvil" class="mention hashtag" rel="nofollow noopener" target="_blank">#CloudflareIsEvil</a> <a href="https://infosec.exchange/tags/LetsEncrypt" class="mention hashtag" rel="nofollow noopener" target="_blank">#LetsEncrypt</a> <a href="https://infosec.exchange/tags/Identity" class="mention hashtag" rel="nofollow noopener" target="_blank">#Identity</a> <a href="https://infosec.exchange/tags/Authenticity" class="mention hashtag" rel="nofollow noopener" target="_blank">#Authenticity</a> <a href="https://infosec.exchange/tags/Phishing" class="mention hashtag" rel="nofollow noopener" target="_blank">#Phishing</a> <a href="https://infosec.exchange/tags/Spoofing" class="mention hashtag" rel="nofollow noopener" target="_blank">#Spoofing</a> <a href="https://infosec.exchange/tags/CyberCrime" class="mention hashtag" rel="nofollow noopener" target="_blank">#CyberCrime</a> <a href="https://infosec.exchange/tags/InfoSec" class="mention hashtag" rel="nofollow noopener" target="_blank">#InfoSec</a> <a href="https://infosec.exchange/tags/AitM" class="mention hashtag" rel="nofollow noopener" target="_blank">#AitM</a> <a href="https://infosec.exchange/tags/MitM" class="mention hashtag" rel="nofollow noopener" target="_blank">#MitM</a> <a href="https://infosec.exchange/tags/Weak2FA" class="mention hashtag" rel="nofollow noopener" target="_blank">#Weak2FA</a> <a href="https://infosec.exchange/tags/WeakMFA" class="mention hashtag" rel="nofollow noopener" target="_blank">#WeakMFA</a> <a href="https://infosec.exchange/tags/DVcerts" class="mention hashtag" rel="nofollow noopener" target="_blank">#DVcerts</a> <a href="https://infosec.exchange/tags/Certificates" class="mention hashtag" rel="nofollow noopener" target="_blank">#Certificates</a> <a href="https://infosec.exchange/tags/ACME" class="mention hashtag" rel="nofollow noopener" target="_blank">#ACME</a> <a href="https://infosec.exchange/tags/USdependencies" class="mention hashtag" rel="nofollow noopener" target="_blank">#USdependencies</a> <a href="https://infosec.exchange/tags/USdependency" class="mention hashtag" rel="nofollow noopener" target="_blank">#USdependency</a> <a href="https://infosec.exchange/tags/USdependent" class="mention hashtag" rel="nofollow noopener" target="_blank">#USdependent</a> <a href="https://infosec.exchange/tags/USAdependencies" class="mention hashtag" rel="nofollow noopener" target="_blank">#USAdependencies</a> <a href="https://infosec.exchange/tags/USAdependency" class="mention hashtag" rel="nofollow noopener" target="_blank">#USAdependency</a> <a href="https://infosec.exchange/tags/USAdependent" class="mention hashtag" rel="nofollow noopener" target="_blank">#USAdependent</a>

Erik van Straten<a href="https://mastodon.laurenweinstein.org/@lauren" class="u-url mention" rel="nofollow noopener" target="_blank">@lauren</a> : in 2020 I wrote a "Secure SMS 2FA Proposal" (<a href="https://security.nl/posting/638976" rel="nofollow noopener" translate="no" target="_blank">https://security.nl/posting/638976</a>) - there's English and Dutch text.The main idea is for the recipient to modify the received code using a shared secret, before entering it as the second factor.Of course weak 2FA (without E2EE channel binding) is not phishing proof, but my proposal should prevent successful SIM-swap attacks (and redirecting calls and messages by manipulating the telco backbone as shown in <a href="https://www.youtube.com/watch?v=wVyu7NB7W6Y" rel="nofollow noopener" translate="no" target="_blank">https://www.youtube.com/watch?v=wVyu7NB7W6Y</a>).I cannot change anything in those postings anymore (and I'm in no way related to security.nl apart from being a regular -unpaid- contributor).Feel free to pass this idea to your contacts at Google as an alternative to QR-codes - from which I fail to understand how they'd improve security. In fact, the unprotected channel from screen with QR-code to the camera recording it, allows for all kinds of (AitM) phishing attacks.<a href="https://sfba.social/@not2b" class="u-url mention" rel="nofollow noopener" target="_blank">@not2b</a> <a href="https://infosec.exchange/tags/SMS" class="mention hashtag" rel="nofollow noopener" target="_blank">#SMS</a> <a href="https://infosec.exchange/tags/2FA" class="mention hashtag" rel="nofollow noopener" target="_blank">#2FA</a> <a href="https://infosec.exchange/tags/MFA" class="mention hashtag" rel="nofollow noopener" target="_blank">#MFA</a> <a href="https://infosec.exchange/tags/Weak2FA" class="mention hashtag" rel="nofollow noopener" target="_blank">#Weak2FA</a> <a href="https://infosec.exchange/tags/WeakMFA" class="mention hashtag" rel="nofollow noopener" target="_blank">#WeakMFA</a> <a href="https://infosec.exchange/tags/NotPhishingResistant" class="mention hashtag" rel="nofollow noopener" target="_blank">#NotPhishingResistant</a>

Erik van Straten<a href="https://infosec.exchange/@patrickcmiller" class="u-url mention" rel="nofollow noopener" target="_blank">@patrickcmiller</a> : oops, from <a href="https://www.csoonline.com/article/3810936/us-takes-aim-at-healthcare-cybersecurity-with-proposed-hipaa-changes.html" rel="nofollow noopener" translate="no" target="_blank">https://www.csoonline.com/article/3810936/us-takes-aim-at-healthcare-cybersecurity-with-proposed-hipaa-changes.html</a>:"the rollout of multi-factor authentication as a defense against phishing"What part of <a href="https://infosec.exchange/tags/Evil" class="mention hashtag" rel="nofollow noopener" target="_blank">#Evil</a> <a href="https://infosec.exchange/tags/Proxy" class="mention hashtag" rel="nofollow noopener" target="_blank">#Proxy</a> do these people not understand?<a href="https://infosec.exchange/tags/EvilProxy" class="mention hashtag" rel="nofollow noopener" target="_blank">#EvilProxy</a> <a href="https://infosec.exchange/tags/PhaaS" class="mention hashtag" rel="nofollow noopener" target="_blank">#PhaaS</a> <a href="https://infosec.exchange/tags/EvilGinx2" class="mention hashtag" rel="nofollow noopener" target="_blank">#EvilGinx2</a> <a href="https://infosec.exchange/tags/Weak2FA" class="mention hashtag" rel="nofollow noopener" target="_blank">#Weak2FA</a> <a href="https://infosec.exchange/tags/WeakMFA" class="mention hashtag" rel="nofollow noopener" target="_blank">#WeakMFA</a> <a href="https://infosec.exchange/tags/2FA" class="mention hashtag" rel="nofollow noopener" target="_blank">#2FA</a> <a href="https://infosec.exchange/tags/MFA" class="mention hashtag" rel="nofollow noopener" target="_blank">#MFA</a> <a href="https://infosec.exchange/tags/Phishing" class="mention hashtag" rel="nofollow noopener" target="_blank">#Phishing</a> <a href="https://infosec.exchange/tags/TwoStepVerification" class="mention hashtag" rel="nofollow noopener" target="_blank">#TwoStepVerification</a> <a href="https://infosec.exchange/tags/FakeWebsite" class="mention hashtag" rel="nofollow noopener" target="_blank">#FakeWebsite</a> <a href="https://infosec.exchange/tags/AitM" class="mention hashtag" rel="nofollow noopener" target="_blank">#AitM</a> <a href="https://infosec.exchange/tags/MitM" class="mention hashtag" rel="nofollow noopener" target="_blank">#MitM</a>

Erik van Straten<a href="https://infosec.exchange/@_r_netsec" class="u-url mention" rel="nofollow noopener" target="_blank">@_r_netsec</a> : Alex Weinert (Identity Security VP at Microsoft) already knew about this in 2019.His recommendation: just keep using Microsoft Authenticator...<a href="https://infosec.exchange/tags/MicrosoftAuthenticator" class="mention hashtag" rel="nofollow noopener" target="_blank">#MicrosoftAuthenticator</a> <a href="https://infosec.exchange/tags/WeakMFA" class="mention hashtag" rel="nofollow noopener" target="_blank">#WeakMFA</a> <a href="https://infosec.exchange/tags/AitM" class="mention hashtag" rel="nofollow noopener" target="_blank">#AitM</a> <a href="https://infosec.exchange/tags/Evilginx2" class="mention hashtag" rel="nofollow noopener" target="_blank">#Evilginx2</a> <a href="https://infosec.exchange/tags/Weak2FA" class="mention hashtag" rel="nofollow noopener" target="_blank">#Weak2FA</a> <a href="https://infosec.exchange/tags/NumberMatching" class="mention hashtag" rel="nofollow noopener" target="_blank">#NumberMatching</a> <a href="https://infosec.exchange/tags/TOTP" class="mention hashtag" rel="nofollow noopener" target="_blank">#TOTP</a> <a href="https://infosec.exchange/tags/AuthenticatorApps" class="mention hashtag" rel="nofollow noopener" target="_blank">#AuthenticatorApps</a> <a href="https://infosec.exchange/tags/MissingDomainNameCheck" class="mention hashtag" rel="nofollow noopener" target="_blank">#MissingDomainNameCheck</a> <a href="https://infosec.exchange/tags/WeakAuthentication" class="mention hashtag" rel="nofollow noopener" target="_blank">#WeakAuthentication</a> <a href="https://infosec.exchange/tags/Authentication" class="mention hashtag" rel="nofollow noopener" target="_blank">#Authentication</a> <a href="https://infosec.exchange/tags/Impersonation" class="mention hashtag" rel="nofollow noopener" target="_blank">#Impersonation</a>

Erik van Straten<a href="https://infosec.exchange/@adamshostack" class="u-url mention" rel="nofollow noopener" target="_blank">@adamshostack</a> : not taking into account that I strongly advise against using weak MFA (because it it not phishing-resistant and comes with a lot of disadvantages "security experts" want nobody to know about):yes.See <a href="https://www.oasis.security/resources/blog/oasis-security-research-team-discovers-microsoft-azure-mfa-bypass" rel="nofollow noopener" translate="no" target="_blank">https://www.oasis.security/resources/blog/oasis-security-research-team-discovers-microsoft-azure-mfa-bypass</a> (yesterday). Source: <a href="https://infosec.exchange/@AAKL/113634744971043868" rel="nofollow noopener" translate="no" target="_blank">https://infosec.exchange/@AAKL/113634744971043868</a>In short (if I understand correctly) Microsoft's servers would accept codes in a time window for upto 3 minutes. This enabled the researchers to conduct a brute force attack.<a href="https://infosec.exchange/tags/WeakMFA" class="mention hashtag" rel="nofollow noopener" target="_blank">#WeakMFA</a> <a href="https://infosec.exchange/tags/Weak2FA" class="mention hashtag" rel="nofollow noopener" target="_blank">#Weak2FA</a> <a href="https://infosec.exchange/tags/TOTP" class="mention hashtag" rel="nofollow noopener" target="_blank">#TOTP</a> <a href="https://infosec.exchange/tags/SMS" class="mention hashtag" rel="nofollow noopener" target="_blank">#SMS</a> <a href="https://infosec.exchange/tags/Voice" class="mention hashtag" rel="nofollow noopener" target="_blank">#Voice</a> <a href="https://infosec.exchange/tags/MFA" class="mention hashtag" rel="nofollow noopener" target="_blank">#MFA</a> <a href="https://infosec.exchange/tags/2FA" class="mention hashtag" rel="nofollow noopener" target="_blank">#2FA</a> <a href="https://infosec.exchange/tags/AitM" class="mention hashtag" rel="nofollow noopener" target="_blank">#AitM</a> <a href="https://infosec.exchange/tags/MitM" class="mention hashtag" rel="nofollow noopener" target="_blank">#MitM</a> <a href="https://infosec.exchange/tags/EvilProxy" class="mention hashtag" rel="nofollow noopener" target="_blank">#EvilProxy</a> <a href="https://infosec.exchange/tags/Evilginx2" class="mention hashtag" rel="nofollow noopener" target="_blank">#Evilginx2</a>

Erik van StratenFrom <a href="https://redmondmag.com/Articles/2024/10/22/Microsoft-Tweaks-Authenticator.aspx" rel="nofollow noopener" translate="no" target="_blank">https://redmondmag.com/Articles/2024/10/22/Microsoft-Tweaks-Authenticator.aspx</a>: ❞ Compliance with the FIPS 140 means organizations that use Authenticator meet the requirements of the Biden administration's Executive Order 14028, which requires government agencies to use phishing-resistant authentications. ❝That is total nonsense. FIPS 140 is about cryptography, which -definitely in this case- has nothing to do with phishing resistance.In fact, the original article (<a href="https://techcommunity.microsoft.com/t5/microsoft-entra-blog/the-latest-enhancements-in-microsoft-authenticator/ba-p/4078807" rel="nofollow noopener" translate="no" target="_blank">https://techcommunity.microsoft.com/t5/microsoft-entra-blog/the-latest-enhancements-in-microsoft-authenticator/ba-p/4078807</a>) does not make that mix-up.Unless software checks whether https is used and the domain name shown in de browser's address bar is correct, MFA is *not* phishing resistant.<a href="https://infosec.exchange/@rogeragrimes" class="u-url mention" rel="nofollow noopener" target="_blank">@rogeragrimes</a> <a href="https://infosec.exchange/tags/TOTP" class="mention hashtag" rel="nofollow noopener" target="_blank">#TOTP</a> <a href="https://infosec.exchange/tags/NumberMatching" class="mention hashtag" rel="nofollow noopener" target="_blank">#NumberMatching</a> <a href="https://infosec.exchange/tags/MFA" class="mention hashtag" rel="nofollow noopener" target="_blank">#MFA</a> <a href="https://infosec.exchange/tags/2FA" class="mention hashtag" rel="nofollow noopener" target="_blank">#2FA</a> <a href="https://infosec.exchange/tags/Weak2FA" class="mention hashtag" rel="nofollow noopener" target="_blank">#Weak2FA</a> <a href="https://infosec.exchange/tags/WeakMFA" class="mention hashtag" rel="nofollow noopener" target="_blank">#WeakMFA</a> <a href="https://infosec.exchange/tags/OTP" class="mention hashtag" rel="nofollow noopener" target="_blank">#OTP</a> <a href="https://infosec.exchange/tags/MicrosoftAuthenticator" class="mention hashtag" rel="nofollow noopener" target="_blank">#MicrosoftAuthenticator</a>

Erik van Straten<a href="https://infosec.exchange/@BradRubenstein" class="u-url mention" rel="nofollow noopener" target="_blank">@BradRubenstein</a> : that tradeoff probably differs a lot if a user is not aware of the existence of IDNs (International Domain Names using Unicode), doesn't know how to interpret domain names, or doesn't look at them at all.Unfortunately Kevin Beaumont apparently blocked me after I wrote this about using a password manager that checks the domain name: <a href="https://infosec.exchange/@ErikvanStraten/113367545890024617" rel="nofollow noopener" translate="no" target="_blank">https://infosec.exchange/@ErikvanStraten/113367545890024617</a>Of course password managers and/or Autofill could be improved if they'd at least warn if a connection is not using https and/or if the current domain name does not exist in the password database.<a href="https://infosec.exchange/@Lee_Holmes" class="u-url mention" rel="nofollow noopener" target="_blank">@Lee_Holmes</a> <a href="https://infosec.exchange/@adamshostack" class="u-url mention" rel="nofollow noopener" target="_blank">@adamshostack</a> <a href="https://cyberplace.social/@GossiTheDog" class="u-url mention" rel="nofollow noopener" target="_blank">@GossiTheDog</a> <a href="https://infosec.exchange/tags/CheckDomainName" class="mention hashtag" rel="nofollow noopener" target="_blank">#CheckDomainName</a> <a href="https://infosec.exchange/tags/Phishing" class="mention hashtag" rel="nofollow noopener" target="_blank">#Phishing</a> <a href="https://infosec.exchange/tags/PasswordManager" class="mention hashtag" rel="nofollow noopener" target="_blank">#PasswordManager</a> <a href="https://infosec.exchange/tags/WeakMFA" class="mention hashtag" rel="nofollow noopener" target="_blank">#WeakMFA</a> <a href="https://infosec.exchange/tags/Weak2FA" class="mention hashtag" rel="nofollow noopener" target="_blank">#Weak2FA</a> <a href="https://infosec.exchange/tags/AitM" class="mention hashtag" rel="nofollow noopener" target="_blank">#AitM</a> <a href="https://infosec.exchange/tags/MitM" class="mention hashtag" rel="nofollow noopener" target="_blank">#MitM</a> <a href="https://infosec.exchange/tags/TOTP" class="mention hashtag" rel="nofollow noopener" target="_blank">#TOTP</a> <a href="https://infosec.exchange/tags/SMS" class="mention hashtag" rel="nofollow noopener" target="_blank">#SMS</a>

Erik van Straten<a href="https://cyberplace.social/@GossiTheDog" class="u-url mention" rel="nofollow noopener" target="_blank">@GossiTheDog</a> : see the image below: no weak MFA and a lot more secure - provided that you follow up my advice in <a href="https://infosec.exchange/@ErikvanStraten/113277630925350550" rel="nofollow noopener" translate="no" target="_blank">https://infosec.exchange/@ErikvanStraten/113277630925350550</a>.Note: TOTP apps *are* a kind of a stupid password manager - one that does *not* check the domain name (as shown in the address bar of the browser). Such an app uses a local database with a unique shared secret per account. Many users have lost access to their accounts because they were unaware of the fact that no backups were made of the database on their devices (e.g. open <a href="https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2" rel="nofollow noopener" translate="no" target="_blank">https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2</a>, open "Ratings and reviews", select "1 star" and optionaly sort on "Newest" to see comments *after* Google enabled automated backups).The above risk is apart from the fact that many TOTP implementations are a privacy nightmare and have extremely insecure implementations *IF* backups are being made.From <a href="https://www.usenix.org/conference/usenixsecurity23/presentation/gilsenan" rel="nofollow noopener" translate="no" target="_blank">https://www.usenix.org/conference/usenixsecurity23/presentation/gilsenan</a>: ❞ Security and Privacy Failures in Popular 2FA Apps Authors: Conor Gilsenan, UC Berkeley / ICSI; Fuzail Shakir and Noura Alomar, UC Berkeley; Serge Egelman, UC Berkeley / ICSI ❝Please stop yelling "Just use MFA" without telling about the additional risks of doing that. Or do you want people to use text message-based 2FA?<a href="https://infosec.exchange/@conorgil" class="u-url mention" rel="nofollow noopener" target="_blank">@conorgil</a> <a href="https://infosec.exchange/tags/CheckDomainName" class="mention hashtag" rel="nofollow noopener" target="_blank">#CheckDomainName</a> <a href="https://infosec.exchange/tags/Phishing" class="mention hashtag" rel="nofollow noopener" target="_blank">#Phishing</a> <a href="https://infosec.exchange/tags/PasswordManager" class="mention hashtag" rel="nofollow noopener" target="_blank">#PasswordManager</a> <a href="https://infosec.exchange/tags/WeakMFA" class="mention hashtag" rel="nofollow noopener" target="_blank">#WeakMFA</a> <a href="https://infosec.exchange/tags/Weak2FA" class="mention hashtag" rel="nofollow noopener" target="_blank">#Weak2FA</a> <a href="https://infosec.exchange/tags/AitM" class="mention hashtag" rel="nofollow noopener" target="_blank">#AitM</a> <a href="https://infosec.exchange/tags/MitM" class="mention hashtag" rel="nofollow noopener" target="_blank">#MitM</a> <a href="https://infosec.exchange/tags/TOTP" class="mention hashtag" rel="nofollow noopener" target="_blank">#TOTP</a> <a href="https://infosec.exchange/tags/SMS" class="mention hashtag" rel="nofollow noopener" target="_blank">#SMS</a>

Erik van StratenEven more secure, use a password manager (*) that recognizes the domain name of the current website, and proposes credentials associated with that domain name (see the screenshot below for Android).(*) On Android, iOS and iPadOS helped by the "Autofill" OS functionality.In addition:• Check by yourself that the connection uses https before you log in.• If your password manager does *not* propose credentials for a website that *looks* like the one you have an account on: it probably is a phishing website. Do *not* search the password manager's database, and in any case: do *not* log in (here's why: <a href="https://www.bleepingcomputer.com/news/security/new-mamba-2fa-bypass-service-targets-microsoft-365-accounts/" rel="nofollow noopener" translate="no" target="_blank">https://www.bleepingcomputer.com/news/security/new-mamba-2fa-bypass-service-targets-microsoft-365-accounts/</a>).• Make backups (preferably offline too) of the password manager's database (regularly and/or after each modification).• As Ian said, let the password manager generate a long random password for each account.Note to <a href="https://eupolicy.social/@1br0wn" class="u-url mention" rel="nofollow noopener" target="_blank">@1br0wn</a> <a href="https://infosec.exchange/@RGB_Lights" class="u-url mention" rel="nofollow noopener" target="_blank">@RGB_Lights</a> : MFA using SMS is too vulnerable for various attacks, and an authenticator app effectively *is* a password manager - but typically incapable of checking domain names, and possibly with a broken or insecure backup strategy.<a href="https://infosec.exchange/tags/Passwords" class="mention hashtag" rel="nofollow noopener" target="_blank">#Passwords</a> <a href="https://infosec.exchange/tags/PasswordManager" class="mention hashtag" rel="nofollow noopener" target="_blank">#PasswordManager</a> <a href="https://infosec.exchange/tags/Phishing" class="mention hashtag" rel="nofollow noopener" target="_blank">#Phishing</a> <a href="https://infosec.exchange/tags/CheckDomainName" class="mention hashtag" rel="nofollow noopener" target="_blank">#CheckDomainName</a> <a href="https://infosec.exchange/tags/WeakMFA" class="mention hashtag" rel="nofollow noopener" target="_blank">#WeakMFA</a> <a href="https://infosec.exchange/tags/Weak2FA" class="mention hashtag" rel="nofollow noopener" target="_blank">#Weak2FA</a>

Erik van Straten<a href="https://infosec.exchange/@macleod" class="u-url mention" rel="nofollow noopener" target="_blank">@macleod</a> wrote: "First login code, second login code."Entered on the same fake website means game over.It may make that more obvious.<a href="https://infosec.exchange/tags/2FA" class="mention hashtag" rel="nofollow noopener" target="_blank">#2FA</a> <a href="https://infosec.exchange/tags/MFA" class="mention hashtag" rel="nofollow noopener" target="_blank">#MFA</a> <a href="https://infosec.exchange/tags/Weak2FA" class="mention hashtag" rel="nofollow noopener" target="_blank">#Weak2FA</a> <a href="https://infosec.exchange/tags/WeakMFA" class="mention hashtag" rel="nofollow noopener" target="_blank">#WeakMFA</a>

Erik van Straten<a href="https://xn--8r9a.com/@north" class="u-url mention" rel="nofollow noopener" target="_blank">@north</a> : SMS *is* 2FA, albeit weak.The problem with "something you know, are, or have" is that users are never told that it is essential that each factor used cannot be easily copied, stolen, guessed etc. or temporarily fall into the wrong hands (literally in this case).Another problem is that if you loose a factor, you may no longer have access to your account.So each factor must be strong, carefully kept secret and needs to be backupped. These are extreme requirements that nobody wants (you) to understand.P.S. both iPhones and Android phones can be configured to *not* show SMS texts (and most other possibly confidential information) on their screen when locked.P.P.S. Unlocked phones are vulnerable to Time Traveler TOTP attacks. An attacker with temporary access to an unlocked phone may change the system date/time to the future, read a TOTP code for a website, and restore correct system time. When the future arrives they can use your TOTP code at their leisure on their own device to log in to your account, and reuse it (within 30 sec.) if required to pwn your account.P.P.P.S. Weak 2FA/MFA does not prevent AitM (Attacker in the Middle) phishing attacks if the AitM uses Evilginx2 or some other "evil proxy" website.2019 "MFA had failed" (by Alex Weinert, Director of Identity Security at Microsoft) <a href="https://techcommunity.microsoft.com/t5/microsoft-entra-azure-ad-blog/all-your-creds-are-belong-to-us/ba-p/855124" rel="nofollow noopener" translate="no" target="_blank">https://techcommunity.microsoft.com/t5/microsoft-entra-azure-ad-blog/all-your-creds-are-belong-to-us/ba-p/855124</a><a href="https://infosec.exchange/@acut3hack" class="u-url mention" rel="nofollow noopener" target="_blank">@acut3hack</a> <a href="https://infosec.exchange/tags/2FA" class="mention hashtag" rel="nofollow noopener" target="_blank">#2FA</a> <a href="https://infosec.exchange/tags/MFA" class="mention hashtag" rel="nofollow noopener" target="_blank">#MFA</a> <a href="https://infosec.exchange/tags/SMS" class="mention hashtag" rel="nofollow noopener" target="_blank">#SMS</a> <a href="https://infosec.exchange/tags/TOTP" class="mention hashtag" rel="nofollow noopener" target="_blank">#TOTP</a> <a href="https://infosec.exchange/tags/WeakMFA" class="mention hashtag" rel="nofollow noopener" target="_blank">#WeakMFA</a> <a href="https://infosec.exchange/tags/Weak2FA" class="mention hashtag" rel="nofollow noopener" target="_blank">#Weak2FA</a> <a href="https://infosec.exchange/tags/AitM" class="mention hashtag" rel="nofollow noopener" target="_blank">#AitM</a> <a href="https://infosec.exchange/tags/MitM" class="mention hashtag" rel="nofollow noopener" target="_blank">#MitM</a> <a href="https://infosec.exchange/tags/EvilProxy" class="mention hashtag" rel="nofollow noopener" target="_blank">#EvilProxy</a> <a href="https://infosec.exchange/tags/Evilginx2" class="mention hashtag" rel="nofollow noopener" target="_blank">#Evilginx2</a> <a href="https://infosec.exchange/tags/TimeTravelerAttacks" class="mention hashtag" rel="nofollow noopener" target="_blank">#TimeTravelerAttacks</a> <a href="https://infosec.exchange/tags/TimeTravelAttacks" class="mention hashtag" rel="nofollow noopener" target="_blank">#TimeTravelAttacks</a> <a href="https://infosec.exchange/tags/PhaaS" class="mention hashtag" rel="nofollow noopener" target="_blank">#PhaaS</a>

Recent searches

Search options

Administered by:

Server stats:

#weak2fa