Collaborate Disseminate
What is the URL located behind the security.php page?
example.com.au/security.php?magId=bZKYnrzADMv0v3o7&mob=854
If there isn’t a way to know that, is there any way to bypass this 2FA?
I enter a URL which gets redirected to the securi… Continue reading Bypassing MFA to access site [closed]
I recently looked into the topic of MFA in combination with some hardware authenticator (USB keys like Nitrokey/Yubico) to potentially improve the overall security of my digital daily activities (web email, online banking, etc).
For this,… Continue reading What types of attacks can MFA using an hardware authenticator prevent?
I recently looked into the topic of MFA in combination with some hardware authenticator (USB keys like Nitrokey/Yubico) to potentially improve the overall security of my digital daily activities (web email, online banking, etc).
For this,… Continue reading What types of attacks can MFA using an hardware authenticator prevent?
Nowadays, 2FA apps usually require you to insert a number which you are presented with when trying to authenticate. For example, the following screenshot is from Microsoft Authenticator:
This is called number matching, and is in contrast … Continue reading What is the point of entering numbers in the two-factor authentication app?
I’ve just added a card to my Apple Wallet and noticed that I didn’t need a PIN. Now since Apple Wallet is apparently already "secure", I don’t need a PIN to use it either.
Is this a loophole or am I missing something?
It is typically recommended to enable 2FA wherever possible. Moreover, it is typically recommended to enable not just any 2FA method, but Yubikeys in particular.
Yubikeys are considered to be the strongest available 2FA method. They are ni… Continue reading How do Yubikeys improve security if I am typically also forced to enable other, weaker 2FA methods?
Where I work, this is the passwordless registration/login flow for our Mobile App
A user registers with a username and a phone number. An SMS OTP is sent to the phone number to verify it.
Initial login: The user logs in to the mobile app … Continue reading How 2FA with Biometrics improve security?
I’m hoping to lead my organization (around 15 people, all remote) in overhauling our security practices, and part of that is making sure each team member is using 2FA on the platforms/tools that offer it. Anyone have any tips for how to go… Continue reading Any tips for organization-wide 2FA enforcement?
I want to secure my mobile app with a passwordless MFA mechanism.
The registration/login flow would be:
You register you account online with a username and a mobile phone (an OTP will be sent to verify the phone number).
You login to the … Continue reading Secure Passwordless MFA authentication on mobile app
Github has just insisted on 2FA, and promptly warns that if you lose your phone, you will lose your access forever if you don’t have the access recovery keys. For me, this is a bigger risk than someone attacking me. I can easily envision m… Continue reading github is insisting on 2FA, with no recovery if you lose recovery keys. Does their app on the same phone help at all if the phone is lost?