News for hackers. Stuff that matters.

A comment on Multi-factor authentication isn't necessarily strong.

Re:Multi-factor authentication isn't necessarily strong by ericalexander3 on Friday December 27, 2019 @01:45PM (#21893314)
U2F > TOTP > Any MFA > no MFA

Why? About 23% of the classified breaches in this data set are due to compromised valid accounts and any MFA would probably have prevented the breach. Often security isn't about out running the bear, it's about out running the person next to you.

data set: https://github.com/ericalexanderorg/SecurityBreach

[ Parent | on HN ]
Re:Multi-factor authentication isn't necessarily strong by tialaramex on Friday December 27, 2019 @02:42PM (#21893862)
New systems should implement WebAuthn rather than U2F.
[ Parent | on HN ]