News for hackers. Stuff that matters.

A comment on Lapsus$ and SolarWinds hackers both use the same old trick to bypass MFA. Parent comment

Re:Lapsus$ and SolarWinds hackers both use the same old tric... by jeroenhd on Wednesday March 30, 2022 @06:52PM (#30861837)
Luckily, MS also allows for FIDO2 and TOTP authenticators so you can make it a lot harder for criminals to get in. Especially with FIDO2 keys, you're pretty unlikely to get phished.

As sibling comments indicate, there is an option to make the request for MFA more secure by providing a number to match your request, but it's pretty dumb that this security feature is disabled by default.

[ Parent | on HN ]
Re:Lapsus$ and SolarWinds hackers both use the same old tric... by vladvasiliu on Thursday March 31, 2022 @01:10AM (#30864004)
> Luckily, MS also allows for FIDO2

This is not universal. It works on Windows with most browsers, but doesn't work on Firefox on Linux (works on Chrome on Linux) nor on Safari on Mac, nor Safari on iPhone, nor Teams on Linux (haven't tried Teams on Mac nor Windows).

[ Parent | on HN ]
Re:Lapsus$ and SolarWinds hackers both use the same old tric... by rdtwo on Thursday March 31, 2022 @09:00AM (#30866680)
The number match still only give you 4 options so 25% chance of entry on Mis click
[ Parent | on HN ]