News for hackers. Stuff that matters.
Re:Hackers went undetected in Citrix’s internal network for ... by u801e on Thursday May 09, 2019 @04:43PM (#19872241)
It seems that you're fixated on the terms used in the discussion rather than the substance of the discussion itself. I already provided an example where someone fell victim to the SIM swap scam because they had their cell phone number on file with their bank.

But rather than addressing the issues where a 3rd party serving as a second factor/step can be compromised without the account holder realizing it in time or the fact that U2F doesn't support other protocols besides HTTPS, you keep going on and on about "security points" which appear to be nebulous in the context of this discussion and also cherry-pick my responses only to go off on a largly irrelevant tangent.

This discussion could have been useful, but, unfortunately, it didn't turn out that way.

Re:Hackers went undetected in Citrix’s internal network for ... by IncRnd on Saturday May 11, 2019 @11:54PM (#19890041)
You misunderstand. I am not fixating on the terms, but the concept underlying the factors of identification. The point, which I stated in my first comment is that you are not taking into consideration the difference between 1.5 factor auth and 2 factor auth. Then, you are further compounding the security error, but discussing other issues instead of directly addressing that your solution doesn't address the threat model. That is why I asked what threats you are guarding against. There is a large body of knowledge here that may be worth your study, cf cia.

Yes, there is a fixation on security, since authentication is a security function that is often gotten wrong when people don't know the threat model and rush through a solution. This has been pointed out to you by several people more than once in this very thread.