Duo's Security Blog

SEPTEMBER 6, 2023

But conventional protection solutions, like password security, fall short when it comes to efficacy. We have a lot of thoughts on passkeys – some of which we’ve shared in other posts in this passkey blog series – and today we’re going to explore how passkeys stack up against passwords from the perspective of cloud platforms.

Passwords 96

Passwords Password Management Authentication Threat Detection 96

Krebs on Security

AUGUST 30, 2022

A recent spate of SMS phishing attacks from one cybercriminal group has spawned a flurry of breach disclosures from affected companies, which are all struggling to combat the same lingering security threat: The ability of scammers to interact directly with employees through their mobile devices. Image: Cloudflare.com.

Mobile 291

Mobile Phishing Authentication Accountability 291

Malwarebytes

FEBRUARY 20, 2023

From March 19, users of Twitter won’t be able to use SMS-based two-factor authentication (2FA) unless they have a subscription to the paid Twitter Blue service. You can still use the authentication app and security key methods. To avoid losing access to Twitter, remove text message two-factor authentication by Mar 19, 2023.

Authentication 92

Authentication Phishing Mobile Accountability 92

Krebs on Security

DECEMBER 4, 2018

Software giant Citrix Systems recently forced a password reset for many users of its Sharefile content collaboration service, warning it would be doing this on a regular basis in response to password-guessing attacks that target people who re-use passwords across multiple Web sites. periodically).

Passwords 213

Passwords Authentication Accountability Password Management 213

Duo's Security Blog

MAY 4, 2023

Our documentary, “ The Life and Death of Passwords ,” explores with industry experts the history of passwords, why passwords have become less effective over time, and how trust is established in a passwordless future. The problems with passwords Chrysta: Why was passwordless needed in the first place?

Passwords 97

Passwords Authentication DNS Technology 97

Duo's Security Blog

NOVEMBER 3, 2022

Once you’ve done that though, a critical next step is answering this question: Once you remove the password, what exactly are users going to use to authenticate? Evaluating your authentication options Duo has always focused on providing a variety of authentication options for end users.

Authentication 86

Authentication Mobile Passwords Risk 86

Duo's Security Blog

MARCH 30, 2021

Passwords have been with us since the early days. When the number of computers on the internet could be counted with two hands, there was the password. When we dialed up for the first time, we used a password. We had a password for Geocities and MySpace. The password might even outlast the corporate data center.

Authentication 97

Authentication Passwords Internet Internet 97

BH Consulting

FEBRUARY 23, 2023

But what happens if you think your mobile has been breached? In this blog, we’ll look at how you can minimise the impact of your personal mobile being compromised. Check and protect what you value most Identify the important apps or files on your mobile phone. (Do Encrypt the data stored on your mobile phone.

Mobile 105

Mobile Hacking Banking VPN 105

Krebs on Security

JANUARY 30, 2024

In each attack, the victims saw their email and financial accounts compromised after suffering an unauthorized SIM-swap, wherein attackers transferred each victim’s mobile phone number to a new device that they controlled. Prosecutors say Noah Michael Urban of Palm Coast, Fla., On July 28 and again on Aug. According to an Aug.

Social Engineering 318

Social Engineering Mobile Cybercrime Passwords 318

Duo's Security Blog

MARCH 2, 2021

And rightly so, no one likes passwords – users have too many to remember and manage, and IT admins spend a lot of time on password-related help desk tickets and password resets. Moreover, compromised passwords are still the leading cause of breach. What is Passwordless Authentication?

Authentication 94

Authentication Passwords Technology Mobile 94

SC Magazine

MAY 7, 2021

Google announced that it will automatically enroll users in multifactor authentication – what they are calling two-step verification. Using their mobile device to sign in gives people a safer and more secure authentication experience than passwords alone,” Risher said. Photo by Mario Tama/Getty Images).

Authentication 89

Authentication Passwords Password Management Mobile 89

Duo's Security Blog

APRIL 19, 2022

OTPs (One-time passwords) have become mainstream because a randomly generated one-time use code solves many of the security problems associated with a static password associated with a static account. What is a One-Time Password? When applicable, encourage users to use other authentication options, such as security keys.

Passwords 96

Passwords Authentication Phishing Accountability 96

Krebs on Security

MARCH 16, 2021

SMS text messages were already the weakest link securing just about anything online, mainly because there are tens of thousands of employees at mobile stores who can be tricked or bribed into swapping control over a mobile phone number to someone else. “It’s an industry-wide thing.

Telecommunications 360

Telecommunications Mobile Wireless Accountability 360

Duo's Security Blog

JANUARY 18, 2023

Multi-Factor Authentication (MFA) is a security tool used by various organizations to protect user credentials, or the username and password. As a first step, organizations need to modernize their authentication, moving away from RADIUS or LDAP protocols and moving towards SAML.

Authentication 89

Authentication Phishing Threat Detection Mobile 89

Duo's Security Blog

FEBRUARY 26, 2021

Duo's two-factor authentication (2FA)/ multi-factor authentication (MFA) offers several methods through which users can verify their identity before being granted access to applications. Today, we'll showcase Step 1, in which we cover the various authentication methods Duo offers.

Authentication 52

Authentication Mobile CISO Passwords 52

Malwarebytes

MARCH 29, 2024

Cybercriminals use MFA bombing to break into accounts that are protected by multi-factor authentication (MFA). MFA normally requires a user to enter a six-digit code sent by SMS, or generated by an app, or to respond to a push notification, when they enter a username and password.

Passwords 122

Passwords Accountability Mobile Authentication 122

Krebs on Security

JUNE 27, 2023

But O’Connor also pleaded guilty in a separate investigation involving a years-long spree of cyberstalking and cryptocurrency theft enabled by “ SIM swapping ,” a crime wherein fraudsters trick a mobile provider into diverting a customer’s phone calls and text messages to a device they control. I haven’t done anything.”

Cryptocurrency 223

Cryptocurrency Accountability Mobile Hacking 223

eSecurity Planet

SEPTEMBER 30, 2021

Underground services are cropping up that are designed to enable bad actors to intercept one-time passwords (OTPs), which are widely used in two-factor authentication programs whose purpose is to better protect customers’ online accounts. By using the services, cybercriminals can gain access to victims’ accounts to steal money.

Authentication 107

Authentication Social Engineering Phishing Banking 107

Duo's Security Blog

MARCH 2, 2022

Multi-factor authentication is one of the best ways to thwart bad actors using stolen credentials — but it’s not foolproof. Year after year, the Verizon Data Breach Report highlights the fact that compromised credentials contribute to the majority of breaches — and MFA remains the strongest mechanism to deter the use of stolen passwords.

Authentication 88

Authentication Phishing DNS Passwords 88

Duo's Security Blog

MAY 12, 2023

Our documentary, “ The Life and Death of Passwords ,” explores with industry experts the history of passwords, why passwords have become less effective over time, and how trust is established in a passwordless future. Ted: Passwords have a bunch of problems from a user perspective. Couldn’t we just fix passwords instead?

Passwords 52

Passwords Authentication Mobile Technology 52

Duo's Security Blog

MAY 23, 2023

Your passwords are on the internet. Talks of passkeys, passphrases, and even password less all point in one direction: eroding faith in the previously trusty password tucked under your keyboard. These habits highlight the need for more modern password technology and stronger authentication methods.

Authentication 131

Authentication Passwords Data breaches Phishing 131

Duo's Security Blog

SEPTEMBER 21, 2021

According to Gartner , 40% of all help desk calls are related to password resets — and those calls are expensive, with Forrester finding each password reset call costs an organization $70. So it comes as no surprise that most businesses want to improve the productivity of their IT help desks and address the password reset cost problem.

Passwords 86

Passwords Social Engineering Authentication Engineering 86

Cisco Security

OCTOBER 19, 2022

You can start with your email accounts (especially any that you use as a recovery email for forgotten passwords, or use for financial, medical, or other sensitive communications). Set a long, unique password for each account. Set up strong authentication using multi-factor authentication wherever it is supported.

Passwords 109

Passwords Authentication Accountability Password Management 109

Duo's Security Blog

OCTOBER 18, 2022

By this point, we’re all familiar with the list of requirements for a strong password: unique, long, memorable, free from any personal information… But even the strongest passwords can pose a risk if they’re the only thing standing between your users and enterprise content.

Insurance 54

Insurance Passwords Cyber Insurance Authentication 54

Duo's Security Blog

JULY 7, 2023

A passkey is a phishing-resistant cryptographic keypair you register for web-based authentication. It’s the strongest authentication method available today, which is why you see passkeys moving to replace passwords altogether. See the video at the blog post. What is a passkey?

Authentication 83

Authentication Passwords Mobile Password Management 83

Duo's Security Blog

FEBRUARY 15, 2024

Multi-factor authentication (MFA) is a well-known and well-established protection that many organizations rely on. Several common authentication methods include the use of one-time passcodes (OTP). Phishing: An attacker sends a user a link to a fake website to capture the user’s username and password.

Social Engineering 114

Social Engineering Authentication Passwords Engineering 114

CyberSecurity Insiders

FEBRUARY 12, 2021

In our blog post from July 2020, we discussed that one way banks are beginning to transition into a more environmentally friendly offering is by using recycled plastic from the oceans in the creation of credit and debit cards. These authentication devices can be made from recycled materials – reducing their overall environmental impact.

Passwords 90

Passwords Financial Services Banking Authentication 90

Duo's Security Blog

JULY 12, 2023

As a technology marketing professional, I use at least 20 applications every day - SaaS/cloud applications and on-premises apps - including email, web-browser based, chat/collaboration, corporate internal apps including Intranet, and mobile apps. I am so glad I don’t have to create or remember passwords for every application.

Mobile 96

Mobile Authentication Marketing Passwords 96

Duo's Security Blog

SEPTEMBER 21, 2022

Like any personal computing device, it requires local authentication to login. Apple provides username and password login for primary authentication and Cisco Duo provides secondary factors to strengthen the macOS security authentication process. The first login it offers the user is the option to enroll in offline login.

Authentication 96

Authentication Mobile Passwords Media 96

Duo's Security Blog

DECEMBER 6, 2022

When someone is told that passwords are going away in favor of a new, “password-less” authentication method, a healthy dose of skepticism is not unwarranted. While this isn’t entirely wrong, passwords are difficult to remember and rarely secure. What is WebAuthn? What is the difference between CTAP1 and CTAP2?

Architecture 93

Architecture Authentication Passwords Technology 93

Malwarebytes

SEPTEMBER 1, 2023

His story begins with an SMS text from LinkedIn telling him to reset his password. He found this confusing: It arrived in the middle of the night, and he hadn't asked for a password reset. Since he doesn’t use the LinkedIn app on his mobile he checked his account on his laptop first thing in the morning.

Accountability 128

Accountability Passwords Mobile Authentication 128

Pentester Academy

MARCH 23, 2023

Lab Walkthrough — Moodle SpellChecker Path Authenticated RCE [CVE-2021–21809] In our lab walkthrough series, we go through selected lab exercises on our INE Platform. Also, to access the upgrade.txt file, we do not need any authentication. set USERNAME moodle set PASSWORD moodle_123321 check The target appears to be vulnerable.

Authentication 52

Authentication Mobile Passwords Penetration Testing 52

Duo's Security Blog

DECEMBER 14, 2023

The email informs John that the company suffered a security breach, and it is essential for all employees to update their passwords immediately. A few days later, John finds himself locked out of his account, and quickly learns that the password reset link he clicked earlier did not come from his company. If it is, access is granted.

Social Engineering 111

Social Engineering Engineering Phishing Passwords 111

Duo's Security Blog

JUNE 3, 2021

Introduction It’s 2030, and passwords are a thing of the past. And then even if we did our due diligence, sometimes a database would get popped and we’d have to go reset our passwords anyway! (If We’ve been using passwords for decades. See the video at the blog post. It’s been an interesting decade. Forget about it.

Authentication 96

Authentication Passwords Phishing Accountability 96

Duo's Security Blog

JULY 15, 2021

Part of our Administrator's Guide to Passwordless blog series See the video at the blog post. Yes, it’s a password-less authentication method, greatly streamlining the login experience, and while that’s a great incentive to use passwordless for logging in, it’s not an improvement in authentication security in and of itself.

Phishing 100

Phishing Authentication Passwords Risk 100

Malwarebytes

MAY 10, 2023

In a recent blog post , the tech giant introduced the option to create and use a safer, more convenient alternative to passwords: Passkeys , a form of digital credential. It also means the account cannot be subject to an attack as a result of a weak password or password re-use, because there is no password.

Passwords 94

Passwords Accountability Phishing Mobile 94

Krebs on Security

MAY 10, 2019

From there, the attackers simply start requesting password reset links via text message for a variety of accounts tied to the hijacked phone number. A separate criminal complaint unsealed this week charges three former employees of mobile phone providers accused of collaborating with The Community’s members.

Mobile 214

Mobile Identity Theft Cryptocurrency Accountability 214