More secure forms of authentication involve “something that you know” alongside “something that you have” (a token) or “something that you are” (biometrics). Hackers have even developed web-based attack tools to dumb down the process of circumventing 2FA, such as the recently uncovered Modlishka utility. Various forms of malware-based attacks targeting 2FA have already been developed. More sophisticated approaches to phishing that incorporate man-in-the-middle attacks can circumvent these protections through schemes geared towards tricking users into handing over their codes as well as their passwords.Įither approach – more accurately described as two-step rather than two-factor authentication – is much better than relying on a password alone, even though it’s far from bullet-proof. Using either an SMS message or automated phone call to receive a one-time code is less secure than using a mobile authentication app such as Google Authenticator or Authy to generate codes. The growing prevalence of SIM-swap scams has rendered this approach perilous. The second factor typically comes in the form of a six-digit number sent by a service provider to a user’s pre-registered mobile phone, either via an SMS message or by an app.Īfter setup, a one-time 2FA code sent via SMS needs to be confirmed before access is granted. Two-factor authentication renders a password and login ID alone not enough to log into an online account. The technology, managed by the FIDO Alliance, makes use of USB or near-field communication (NFC) technology, and is similar to that widely found in smart cards. U2F (Universal 2nd Factor) is an open authentication standard designed to strengthen two-factor authentication (2FA).
The use of hardware security keys to secure online accounts against phishing is being heavily promoted by the industry, but tests by The Daily Swig have shown that the technology remains poorly supported by websites and browsers.Įven some consumer-focused services that support U2F-based authentication – such as Facebook and Twitter – fall back to supporting less secure app or SMS-based authentication in the absence of a hardware key, undermining most of the extra security protections the tech might otherwise offer. Anti-phishing tech is anything but universal
0 kommentar(er)
