News for hackers. Stuff that matters.

A comment on Hackers breached Colonial Pipeline using compromised password. Parent comment

Re:Hackers breached Colonial Pipeline using compromised pass... by vladvasiliu on Saturday June 05, 2021 @03:18AM (#27402957)
While not U2F but pretty close for the issue at hand (preventing phishing), any VPN that supports radius as a backend can use Windows NPS which can be integrated with Azure AD MFA to send a notification to the phone.

You may still want to train the users not to accept any random request on the app, though. But this works (fairly) well and is cheap (no hardware token to buy).

https://docs.microsoft.com/en-us/azure/active-directory/auth...

[ Parent | on HN ]
Re:Hackers breached Colonial Pipeline using compromised pass... by tialaramex on Saturday June 05, 2021 @04:14PM (#27408136)
Phone confirmation doesn't evade phishing. The user doesn't think the request they just got on the app is "random" because they think they're doing the right thing. The whole idea of phishing is to trick the human user.
[ Parent | on HN ]