Category Archives: twofactorauthentication

Google Employees Use a Physical Token as Their Second Authentication Factor

Posted on by

Krebs on Security is reporting that all 85,000 Google employees use two-factor authentication with a physical token. A Google spokesperson said Security Keys now form the basis of all account access at Google. "We have had no reported or confirmed account takeovers since implementing security keys at Google," the spokesperson said. "Users might be asked to authenticate using their security… Continue reading Google Employees Use a Physical Token as Their Second Authentication Factor→

Perverse Vulnerability from Interaction between 2-Factor Authentication and iOS AutoFill

Posted on by

Apple is rolling out an iOS security usability feature called Security code AutoFill. The basic idea is that the OS scans incoming SMS messages for security codes and suggests them in AutoFill, so that people can use them without having to memorize or … Continue reading Perverse Vulnerability from Interaction between 2-Factor Authentication and iOS AutoFill→

Perverse Vulnerability from Interaction between 2-Factor Authentication and iOS AutoFill

Posted on by

Apple is rolling out an iOS security usability feature called Security code AutoFill. The basic idea is that the OS scans incoming SMS messages for security codes and suggests them in AutoFill, so that people can use them without having to memorize or type them. Sounds like a really good idea, but Andreas Gutmann points out an application where this… Continue reading Perverse Vulnerability from Interaction between 2-Factor Authentication and iOS AutoFill→

New Technique to Hijack Social Media Accounts

Posted on by

Access Now has documented it being used against a Twitter user, but it also works against other social media accounts: With the Doubleswitch attack, a hijacker takes control of a victim’s account through one of several attack vectors. People who have not enabled an app-based form of multifactor authentication for their accounts are especially vulnerable. For instance, an attacker could… Continue reading New Technique to Hijack Social Media Accounts→

Criminals are Now Exploiting SS7 Flaws to Hack Smartphone Two-Factor Authentication Systems

Posted on by

I’ve previously written about the serious vulnerabilities in the SS7 phone routing system. Basically, the system doesn’t authenticate messages. Now, criminals are using it to hack smartphone-based two-factor authentication systems: In short, the issue with SS7 is that the network believes whatever you tell it. SS7 is especially used for data-roaming: when a phone user goes outside their own provider’s… Continue reading Criminals are Now Exploiting SS7 Flaws to Hack Smartphone Two-Factor Authentication Systems→

NIST is No Longer Recommending Two-Factor Authentication Using SMS

Posted on by

NIST is no longer recommending two-factor authentication systems that use SMS, because of their many insecurities. In the latest draft of its Digital Authentication Guideline, there’s the line: [Out of band verification] using SMS is deprecated, and will no longer be allowed in future releases of this guidance…. Continue reading NIST is No Longer Recommending Two-Factor Authentication Using SMS→