Multi-factor authentication isn't necessarily strong

Re:Multi-factor authentication isn't necessarily strong by acdha on Friday December 27, 2019 @12:57PM (#21892905)

Note that responsible sites do variations on IP / location fixation to reduce the value of exfiltrated session cookies and, of course, they're only valid for as long as you go between verifications. One really nice thing about FIDO is that it affords a low-pain “tap the button to confirm it's you” verification instead of a full password challenge.

[ Parent | on HN ]

Re:Multi-factor authentication isn't necessarily strong by eeZah7Ux on Wednesday January 01, 2020 @09:44AM (#21928207)

The attacker can very easily use your workstation as a vantage point. Even used directly your browser and your SSH sessions.

It's makes it even more difficult to detect and trace.

[ Parent | on HN ]

Re:Multi-factor authentication isn't necessarily strong by acdha on Thursday January 02, 2020 @02:28PM (#21938802)

Yes, which is a different threat than what was under discussion. Don't argue that we don't need seatbelts because they don't help when the driver is a kidnapper.

[ Parent | on HN ]