R/reddit on Reddit: We had a security incident. #mfa #fido #fido2 #phishing #reddit #passwordless #passwordmanager then we would have some good, useful, and cost-effective phishing-resistant tokens! Now add some AI to it, to use some smart behavior detection. then I think we would be in a good position to massively adopt FIDO and add really good security measures against credentials attacks, and leverage the use of passwordless authentication.

Once we have phishing-resistant FIDO-based mobile tokens, where you can securely use your mobile phone, and leverage protocols such as Bluetooth, for example, and geolocation based also on connected devices (your home or company wifi devices, for example), all unlocked by secure biometrics. And for regular users, they should always get security training to better identify, or be conscious about phishing and targeted attacks, and push-based mobile tokens with geolocation and some other risk-based authentication security methods should be used. In my opinion, while I'm not a big fan of hardware tokens (why can't I just use my mobile phone as a 'hardware token'?), for critical access, phishing-resistant FIDO hardware tokens should be always used. If event-based (not recommended at all!) or 'backup codes', which can be used at any time, they could login into the employee's account later. By passcodes, if they were time-based, the attacker would need to use it right away. Now, it seems an internal employee was targeted, being redirected to a fake website mimicking their intranet, in order to steal the employees credentials AND passcodes. It doesn't look like they learned the lesson. Definitely, a targeted attack would be successful. As noted by NIST a couple years earlier, SMS and Voice based OTPs shouldn't be used, since there were many ways to hack it. In 2018, Reddit users that enabled SMS-based MFA were hacked.

Is lastpass safe reddit