Multi-factor Authentication - Revision history

Tom: /* Other Authentication factors and external links */

2024-09-26T01:15:57Z

‎Other Authentication factors and external links

Tom: /* Fraud */

2024-08-09T23:57:50Z

‎Fraud

Tom: /* Fraud */

2024-08-09T23:48:32Z

‎Fraud

Tom: /* Exploits */

2024-08-09T23:39:45Z

‎Exploits

Tom: /* Other Authentication factors and external links */

2023-12-22T20:39:50Z

‎Other Authentication factors and external links

Tom: /* Exploits */

2023-09-16T00:24:23Z

‎Exploits

Tom: /* The Problems */

2022-07-13T20:27:44Z

‎The Problems

Tom: /* Standard categories of Authentication Factors */

2021-10-06T18:56:13Z

‎Standard categories of Authentication Factors

Tom: /* Context */

2021-10-06T18:55:36Z

‎Context

Tom: /* The Problems */

2021-04-18T18:04:05Z

‎The Problems

@@ Line 51: / Line 51: @@
 # [https://github.com/martinpaljak/x509-webauth/wiki/WebAuth WebAuth] an effort is to define a simple challenge-response authentication mechanism for PKI (X509) roll-outs, with a standardized token format for transporting the claim and a standard API for website developers to request for that authentication token, to overcome a set of issues present with client certificate authentication in the web context.
 # [https://ux.stackexchange.com/questions/115376/good-ux-practices-for-2-factor-authentication-2fa Good UX Practices for 2 factor Authentication] also discusses drop off from using other authentication factors.
 [[Category:Glossary]]
 [[Category:Authentication]]
 [[Category: Factor]]

@@ Line 20: / Line 20: @@
 * The person says “Hi I’m from Your bank, did you initiate a wire transfer to Jack Rowen, was it you?”
 * You say “No, it was fraud”
 *  The caller says “Ok I need to block the wire, but in order to do so I need to confirm you are who you say you are. So we’re going to send a code to your phone and we need you to read the code back to me.”
 *  Once that code is read back - the damage is done as the bank cannot validate you beyond our device. This is the major flaw with every security vendor out there that bases their security on device and assumptions.

@@ Line 14: / Line 14: @@
 * [https://www-bleepingcomputer-com.cdn.ampproject.org/c/s/www.bleepingcomputer.com/news/security/microsoft-phishing-bypassed-mfa-in-attacks-against-10-000-orgs/amp/ Microsoft: Phishing bypassed MFA in attacks against 10,000 orgs] (2022-07-12) Microsoft says a massive series of phishing attacks has targeted more than 10,000 organizations starting with September 2021, using the gained access to victims' mailboxes in follow-on business email compromise (BEC) attacks.
 ===Fraud===
-The assumption that all users can understand who MFA works is an example of pushing security concerns onto the user and declaiming any liability if the user cooperates.
+The assumption that all users can understand who MFA works is an example of pushing security concerns onto the user and declaiming any liability if the user cooperates. Here’s how the scam works:
 * You get a text message that says, “Are you sure you want to send a wire transfer of $5,000 to Jack Rowen? Please text Yes or No”
 * You reply “no”

@@ Line 13: / Line 13: @@
 * Unfortunately, Google employs dark patterns to convince you to sync your MFA codes to the cloud, and Retool employee had indeed activated this “feature”. If you install Google Authenticator from the app store directly, and follow the suggested instructions, your MFA codes are by default saved to the cloud. If you want to disable it, there isn’t a clear way to “disable syncing to the cloud”, instead there is just a “unlink Google account” option. In the Retools corporate Google account, there is also no way for an administrator to centrally disable Google Authenticator’s sync “feature”. (2023-09-15)
 * [https://www-bleepingcomputer-com.cdn.ampproject.org/c/s/www.bleepingcomputer.com/news/security/microsoft-phishing-bypassed-mfa-in-attacks-against-10-000-orgs/amp/ Microsoft: Phishing bypassed MFA in attacks against 10,000 orgs] (2022-07-12) Microsoft says a massive series of phishing attacks has targeted more than 10,000 organizations starting with September 2021, using the gained access to victims' mailboxes in follow-on business email compromise (BEC) attacks.
 ==The Solutions==

← Older revision		Revision as of 20:39, 22 December 2023
Line 37:		Line 37:
	[[Category:Glossary]]		[[Category:Glossary]]
	[[Category:Authentication]]		[[Category:Authentication]]
		+	[[Category: Factor]]

@@ Line 11: / Line 11: @@
 * When more than one factor is independently created, there is always a new attack point created. This became very clear when the Duo 2FA was tricked into sending authentications to the wrong subject.<ref>John Leyden, ''Researchers trick Duo 2FA into sending authentication request to attacker-controlled device'' (2021-04-21) Portswigger https://portswigger.net/daily-swig/amp/researchers-trick-duo-2fa-into-sending-authentication-request-to-attacker-controlled-device</ref> This attack emphasizes the importance of proper binding among all of the factors used in authentication.
 ===Exploits===
 * [https://www-bleepingcomputer-com.cdn.ampproject.org/c/s/www.bleepingcomputer.com/news/security/microsoft-phishing-bypassed-mfa-in-attacks-against-10-000-orgs/amp/ Microsoft: Phishing bypassed MFA in attacks against 10,000 orgs] (2022-07-12) Microsoft says a massive series of phishing attacks has targeted more than 10,000 organizations starting with September 2021, using the gained access to victims' mailboxes in follow-on business email compromise (BEC) attacks.

@@ Line 16: / Line 16: @@
 As originally conceived, MFA was primarily a means to increase the assurance of an authentication being accurate. The technique of having multiple factors is in the process of changing into one that is used by [[Authorization]] services to determine if users have specific [[Attribute]]s or [[Proof of Possession]] of some secret supplied by the [[Resource]] owner.
-===Standard categories of Authentication Factors===
+===Standard categories of [[Authentication Factor]]s===
 #Something you know, like a password
 #Something you have, like a U2F key or [[Smart Card]]

@@ Line 3: / Line 3: @@
 ==Context==
-As a part of authorizing a [[Subject]] to access a digital resource the [[Web Site]] hosting that resource will need to acquire a set of [[Claims]] that apply to the [[Subject]] for the duration of the access. While this [[Authorization]] process can begin with the [[Authentication]] of the [[Subject]] with something as simple as a statement from the [[Subject]], additional steps may be necessary including using other [[Authentication]] factors. Standards like NIST SP 800-63 address this need as a part of the [[Authentication]] process by requiring the additional factors prior to attempting access. Most commercial [[Web Site]]s use a hybrid approach where [[Authentication]] is minimal and additional factors are address as needed to avoid early drop off by [[Consumer]]s of their resources.
+As a part of authorizing a [[Subject]] to access a digital resource the [[Web Site]] hosting that resource will need to acquire a set of [[Claim]]s that apply to the [[Subject]] for the duration of the access. While this [[Authorization]] process can begin with the [[Authentication]] of the [[Subject]] with something as simple as a statement from the [[Subject]], additional steps may be necessary including using other [[Authentication]] factors. Standards like NIST SP 800-63 address this need as a part of the [[Authentication]] process by requiring the additional factors prior to attempting access. Most commercial [[Web Site]]s use a hybrid approach where [[Authentication]] is minimal and additional factors are address as needed to avoid early drop off by [[Consumer]]s of their resources.
 ==The Problems==

@@ Line 9: / Line 9: @@
 *There are downsides to using another authentication factor during a sign-in process. For example if care is not taken the [[User]] could lose access to their accounts entirely. Most sites offer a back-up [[Recovery]] process, but that obviates some of the ease-of-use characteristics of factors like [[FIDO U2F]] [[Security Token]]s.<ref>Stuart Schechter, ''Before You Turn On Two-Factor Authentication…'' https://medium.com/@stuartschechter/before-you-turn-on-two-factor-authentication-27148cc5b9a1</ref>
 *The most common second factor in use in 2017 is the use of the phone number to contact the user. This factor starting in the 1980's with call-back devices prior to establishing a modem connection. Today the most common usage is the SMS message sent to a cell phone. The essential problem is that phone companies have never accepted any responsibility for the security of the phone number and numerous cases of successful attacks against the use of the phone number as a [[Recovery]] mechanism on user's access to valuable resources.<ref>Lorenzo Franceschi-Bicchierai ''The SIM Hijackers'' https://motherboard.vice.com/en_us/article/vbqax3/hackers-sim-swapping-steal-phone-numbers-instagram-bitcoin</ref>
-* When more than one factor is independently crated, there is always a new attack point created. This became very clear when the Duo 2FA was tricked into sending authentications to the wrong subject.<ref>John Leyden, ''Researchers trick Duo 2FA into sending authentication request to attacker-controlled device'' (2021-04-21) Portswigger https://portswigger.net/daily-swig/amp/researchers-trick-duo-2fa-into-sending-authentication-request-to-attacker-controlled-device</ref> This attack emphasizes the importance of proper binding among all of the factors used in authentication.
+* When more than one factor is independently created, there is always a new attack point created. This became very clear when the Duo 2FA was tricked into sending authentications to the wrong subject.<ref>John Leyden, ''Researchers trick Duo 2FA into sending authentication request to attacker-controlled device'' (2021-04-21) Portswigger https://portswigger.net/daily-swig/amp/researchers-trick-duo-2fa-into-sending-authentication-request-to-attacker-controlled-device</ref> This attack emphasizes the importance of proper binding among all of the factors used in authentication.
 ==The Solutions==