Lapsus$ and SolarWinds hackers both use the same old trick to bypass MFA

Re:Lapsus$ and SolarWinds hackers both use the same old tric... by mcintyre1994 on Wednesday March 30, 2022 @03:07PM (#30859502)

I quite like Google's approach, where you don't get a notification and have to go into the app to get the pop up. My bank does the same thing, you have to go into the app without a notification, see the pending transaction in your list and then approve/reject it. Feels a lot safer than push notifications for sure.

[ Parent | on HN ]

Re:Lapsus$ and SolarWinds hackers both use the same old tric... by koolba on Wednesday March 30, 2022 @08:29PM (#30862496)

Your bank lets you approve and reject individual transitions in real time or just ones that get flagged by them for fraud?

[ Parent | on HN ]

Re:Lapsus$ and SolarWinds hackers both use the same old tric... by mcintyre1994 on Thursday March 31, 2022 @01:45AM (#30864189)

It’s their implementation of 3D Secure for online payments, which I think is based on a combination of heuristics and the merchant opting in/out. It’s a very good UX though, banks I’ve used in the past would ask you to enter some characters of your password on a weird looking 3D secure page.

This is their blog when they announced it: https://monzo.com/blog/2018/08/22/launching-3d-secure

[ Parent | on HN ]