[Перевод] OpenAM и Zero Trust: Подтверждение критичных операций

Один из принципов нулевого доверия гласит: никогда не доверяй, всегда проверяй (Never trust, always verify). В этой статье мы рассмотрим, как реализовать соблюдение такого принципа в системе аутентификации на примере продуктов с открытым исходным кодом OpenAM и OpenIG .

https://habr.com/ru/articles/905824/

In questa #newsletter parliamo di:
#Virale vuol dire ancora qualcosa?
Buon World #Password Day! Tra #MIT, #Hacker, #Infostealer e #MFA. Perchè sono così vulnerabili
Perché #Tiktok ha preso una multa da mezzo miliardo in #Europa
#Meta lancia la sua app #IA personale: un assistente vocale che può fare anche da #social
#AI, come le #BigTech indeboliscono il codice di buone pratiche europeo

@informatica

https://bit.ly/3GFpP6w

#Phishing attacks that defeat #MFA are easier than ever. So what are we to do?
#privacy #2fa #security

https://arstechnica.com/security/2025/05/phishing-attacks-that-defeat-mfa-are-easier-than-ever-so-what-are-we-to-do/

Why #MFA is getting easer to bypass and what to do about it

https://arstechnica.com/security/2025/05/phishing-attacks-that-defeat-mfa-are-easier-than-ever-so-what-are-we-to-do/

When using #passkeys I experience one of these 3 behaviors:

1. Immediately logged in (even if #MFA is enabled)
2. I’m prompted for an MFA token
3. I’m only asked for my passkey after I’ve entered some amount of other information. Possibly just and email or phone number or sometimes my full login/password where the passkey is acting as an MFA token.

Would be nice if this was consistent. Feels like rolling UX dice every time.

Why #MFA is getting easier to bypass and what to do about it: Why #multiFactorAuthentication based on one-time passwords and push notifications fails, 20250501,
by Dan G,
https://arstechnica.com/security/2025/05/phishing-attacks-that-defeat-mfa-are-easier-than-ever-so-what-are-we-to-do/

— mentioned #passkey, #webAuthn

Why MFA is getting easer to bypass and what to do about it - An entire cottage industry has formed around phishing attacks that bypass ... - https://arstechnica.com/security/2025/05/phishing-attacks-that-defeat-mfa-are-easier-than-ever-so-what-are-we-to-do/ #multifactorauthentication #passwords #security #phishing #webauthn #biz⁢ #mfa

State-of-the-art phishing: MFA bypass - Cybercriminals are bypassing multi-factor authentication (MFA) using adversary-in-the-mid... https://blog.talosintelligence.com/state-of-the-art-phishing-mfa-bypass/ #ontheradar #phishing #mfa

Verizon DBIR 2025: Ökande hot och trender i cybersäkerhet -Cybersäkerhet och IT-säkerhet

Läs mer på bloggen: https://kryptera.se/verizon-dbir-2025-okande-hot-och-trender-i-cybersakerhet/

Well.. things you do in Hospitals.
Just a little cutter knife here and super glue there and.. my phone now carries a YubiCat5c security dongle.

New threat alert! SessionShark phishing kit can bypass Microsoft Office 365 MFA, stealing session tokens and putting your cloud accounts at risk. Stay ahead of attackers—discover how to defend your org now.

Learn more: https://zerodaily.me/blog/2025-04-26-microsoft-office-365-mfa-bypassed-by-sessionshark-phishing-kit

Ukraine’s MFA handed the ambassador evidence of the Chinese involvement in the military production in russia

#Beijing #China #MFA #russia #Ukraine #war

https://uatribune.com/en/ukraine-s-mfa-handed-ambassador-evidence-of-the-chinese-involvement-in-the-military-production-in-russia/

Phishing isn't what it used to be—attackers are now using dynamic sites that dodge multi-factor security in real time. Can your defenses keep up with this next-level identity theft?

https://thedefendopsdiaries.com/the-evolution-of-phishing-attacks-from-links-to-identity-theft/

#phishingattacks
#identitytheft
#cybersecurity
#mfa
#realtimedetection

PSA: FAKE Microsoft Authenticator apps are flooding the App Store & Play Store!

Protect your users!

ONLY send them to the official download link

Bookmark this! Update your user guides & intranet NOW. RT to spread the word!

#CyberSecurity #MFA

↓

Someone wants in.
I got a request on my #MFA app when I wasn't logging in, so denied the request. But, if I got an MFA request, that means they have my password.
Gotta love MFA! It saves you from most breached password attacks.
Password is now updated--and longer--so I should be good until the next breach.

#MFAEverything for #Security!

I think it's interesting that RSA Conference doesn't offer MFA when creating an account and signing in.

I know it's only a conference but...