News for hackers. Stuff that matters.

A comment on Hackers went undetected in Citrix’s internal network for six months. Parent comment

Re:Hackers went undetected in Citrix’s internal network for ... by inapis on Tuesday April 30, 2019 @11:46PM (#19794374)
Ha. Perfect. That is exactly what I was imagining. Apologies for the long conversation.

Do you have any idea why this is not popular? Is it too hard to implement or is it just that business's do not see security as something to invest a lot in?

[ Parent | on HN ]
Re:Hackers went undetected in Citrix’s internal network for ... by Godel_unicode on Tuesday April 30, 2019 @11:56PM (#19794413)
Most major SaaS apps support it, the major hardware provider I see recommended is yubikey although Google makes one as well. See also U2f. It's super easy to implement, try it out for yourself in Flask.

https://www.yubico.com/solutions/fido-u2f/

https://cloud.google.com/titan-security-key/

https://github.com/herrjemand/flask-fido-u2f

[ Parent | on HN ]
Re:Hackers went undetected in Citrix’s internal network for ... by Rafert on Wednesday May 01, 2019 @12:13AM (#19794482)
U2F is the legacy protocol, you should refer people to it's successor WebAuthn (and the FIDO2 hardware):

https://webauthn.guide/ for an intro

https://www.w3.org/TR/webauthn/ for the JS API

[ Parent | on HN ]