Troy Hunt

MARCH 10, 2021

Pwned Passwords is a repository of 613M passwords exposed in previous data breaches, which makes them very poor choices for future use. They're totally free and they have a really cool anonymity API that ensures no useful information about the password being searched for is ever exposed.

Passwords 349

Passwords IoT Password Management Data breaches 349

The Last Watchdog

DECEMBER 6, 2021

For IT leaders, passwords no longer cut it. This traditional authentication method is challenging to get rid of, mostly because it’s so common. Every new account you sign up for, application you download, or device you purchase requires a password. Lowering password use. So why are they still around?

Authentication 251

Authentication Passwords Mobile Phishing 251

Malwarebytes

OCTOBER 6, 2023

Recently, Amazon announced that it will require all privileged Amazon Web Services (AWS) accounts to use multi-factor authentication (MFA) , starting in mid-2024. Our regular readers will know that we feel that passwords alone are not adequate protection , especially not for your important accounts.

Authentication 121

Authentication Passwords Social Engineering Accountability 121

Heimadal Security

MARCH 4, 2022

Two-factor authentication, also called multiple-factor or multiple-step verification, is an authentication mechanism used to double-check that your identity is legitimate. How Does Two-Factor Authentication Work? Two-factor authentication works as an […].

Authentication 126

Authentication Passwords Accountability 126

Schneier on Security

DECEMBER 14, 2018

Attackers are targeting two-factor authentication systems: Attackers working on behalf of the Iranian government collected detailed information on targets and used that knowledge to write spear-phishing emails that were tailored to the targets' level of operational security, researchers with security firm Certfa Lab said in a blog post.

Authentication 203

Authentication Passwords Phishing Government 203

Troy Hunt

JULY 8, 2019

Almost 2 years ago to the day, I wrote about Passwords Evolved: Authentication Guidance for the Modern Era. This wasn't so much an original work on my behalf as it was a consolidation of advice from the likes of NIST, the NCSC and Microsoft about how we should be doing authentication today. 3,768,890 passwords.

Passwords 234

Passwords Accountability Authentication Data breaches 234

Krebs on Security

FEBRUARY 4, 2021

Facebook, Instagram , TikTok , and Twitter this week all took steps to crack down on users involved in trafficking hijacked user accounts across their platforms. Facebook said it targeted a number of accounts tied to key sellers on OGUsers, as well as those who advertise the ability to broker stolen account sales. THE MIDDLEMEN.

Accountability 304

Accountability Hacking Media Mobile 304

Duo's Security Blog

JANUARY 26, 2024

In today’s complex IT landscape, one of the biggest problems faced by a Chief Information Security Officer (CISO) and their IT security team are forgotten and stolen passwords. On average, employees lose 11 hours per year resetting passwords and an average company spends ~$5M per year on setting and resetting passwords.

Passwords 90

Passwords Authentication Mobile CISO 90

eSecurity Planet

MAY 4, 2023

In a major move forward for passwordless authentication, Google is introducing passkeys across Google Accounts on all major platforms. ” Google’s move will make passkeys an additional verification option alongside passwords and two-factor verification. .'” Passkeys can be created within Google accounts at g.co/passkeys.

Authentication 98

Authentication Passwords Accountability Phishing 98

Malwarebytes

SEPTEMBER 1, 2023

Not long ago I wrote about a recent campaign to hold LinkedIn users' accounts to ransom. His story begins with an SMS text from LinkedIn telling him to reset his password. He found this confusing: It arrived in the middle of the night, and he hadn't asked for a password reset. Rest assured, we're doing our best to assist you!

Accountability 125

Accountability Passwords Mobile Authentication 125

Troy Hunt

SEPTEMBER 17, 2019

Allow me to be controversial for a moment: arbitrary password restrictions on banks such as short max lengths and disallowed characters don't matter. Also, allow me to argue with myself for a moment: banks shouldn't have these restrictions in place anyway. 6 characters. for my *online banking*.

Banking 238

Banking Passwords Accountability Authentication 238

Krebs on Security

DECEMBER 4, 2018

Software giant Citrix Systems recently forced a password reset for many users of its Sharefile content collaboration service, warning it would be doing this on a regular basis in response to password-guessing attacks that target people who re-use passwords across multiple Web sites. periodically).

Passwords 219

Passwords Authentication Accountability Password Management 219

Security Boulevard

DECEMBER 5, 2023

In an increasingly digital age, the basic username-password combination is no longer sufficient to safeguard online accounts. Two words, one huge security difference: Multi-Factor Authentication (MFA).

Authentication 57

Authentication Passwords Accountability 57

Krebs on Security

MARCH 13, 2019

[ NASDAQ: SZMK ] says it is investigating a security incident in which a hacker was reselling access to a user account with the ability to modify ads and analytics for a number of big-name advertisers. He acknowledged that the purloined account had the ability to add or modify the advertising creatives that get run on customer ad campaigns.

Accountability 219

Accountability Passwords Advertising Penetration Testing 219

Adam Levin

JANUARY 18, 2019

A gigantic trove of email addresses and passwords containing over 2 billion records has been discovered online. The breached data, dubbed “Collection #1” by cybersecurity expert Troy Hunt , is more than 87 gigabytes and contains roughly 773 million email address and 21 million unique passwords.

Accountability 198

Accountability Passwords Data breaches Data collection 198

Malwarebytes

FEBRUARY 20, 2023

From March 19, users of Twitter won’t be able to use SMS-based two-factor authentication (2FA) unless they have a subscription to the paid Twitter Blue service. You can still use the authentication app and security key methods. To avoid losing access to Twitter, remove text message two-factor authentication by Mar 19, 2023.

Authentication 95

Authentication Phishing Mobile Accountability 95

Duo's Security Blog

JUNE 8, 2023

Some of it is positive, but the general consensus is that people don’t love multi-factor authentication (MFA); they see it as a necessary evil at best. That’s why I’m so excited to announce our vision to streamline Duo’s authentication workflows, a feature that will deliver seamless, secure login experiences.

Authentication 112

Authentication VPN System Administration Engineering 112

Security Boulevard

FEBRUARY 9, 2022

Disclaimer: Before we start, the following applies to regular user accounts and is not advisable for privileged accounts or accounts that are unable to use multi-factor authentication (MFA). As users, aren’t we sick of being forced to change our passwords for no reason? The Problem?

Passwords 96

Passwords Accountability Authentication 96

Heimadal Security

OCTOBER 12, 2021

The SSH protocol used by GitHub allows you to log in without a user name or password. To do this, users would need to establish an SSH keypair and add the public key to their accounts’ SSH key settings. The post GitHub Revokes Duplicate SSH Authentication Keys appeared first on Heimdal Security Blog.

Authentication 88

Authentication Passwords Accountability Cybersecurity 88

IT Security Guru

JULY 23, 2021

Stealing access to your environment using a known password for a user account is a much easier way to compromise systems than relying on other vulnerabilities. Therefore, using good password security and robust password policies is an excellent way for organizations to bolster their cybersecurity posture.

Policy Compliance 120

Policy Compliance Passwords Accountability Authentication 120

Cisco Security

MARCH 15, 2022

Guidance is provided in the Recommendations and Best Practices section of this blog. According to the FBI’s bulletin, cyber actors were able to obtain access to primary credentials for users with Duo accounts that did not have an enrolled multi-factor authentication (MFA) device. Recommendations and Best Practices.

Authentication 109

Authentication Passwords Accountability Government 109

Duo's Security Blog

SEPTEMBER 6, 2023

But conventional protection solutions, like password security, fall short when it comes to efficacy. We have a lot of thoughts on passkeys – some of which we’ve shared in other posts in this passkey blog series – and today we’re going to explore how passkeys stack up against passwords from the perspective of cloud platforms.

Passwords 69

Passwords Password Management Authentication Threat Detection 69

Malwarebytes

DECEMBER 21, 2021

On his blog , Troy Hunt has announced a major milestone in the ‘Have I Been Pwned?’ This enormous injection of used passwords has puffed up the world’s largest publicly available password database by 38%, according to Hunt. If it says a password you use has breached, you know to never use it again. Have I Been Pwned?’.

Passwords 139

Passwords Password Management Authentication Data breaches 139

Heimadal Security

OCTOBER 6, 2021

The 2FA technique, often known as two-factor authentication, is essentially a two-step verification, as the name suggests. Users log in using two authentication factors: one can be a password or a passcode, while the other can be a biometric factor (such as a facial scan or fingerprints) or a security token.

Accountability 91

Accountability Authentication Passwords Cybersecurity 91

CyberSecurity Insiders

OCTOBER 18, 2021

This blog was written by an independent guest blogger. Having a weak password policy is a key vector for attackers to gain system access. However, admins can help protect password security of the wide-reaching network using Group Management Policy (GPO). But what's domain password policy?

Passwords 136

Passwords Accountability Encryption Architecture 136

Google Security

FEBRUARY 23, 2021

Passwords are usually the first line of defense against hackers, and with the number of data breaches that could publicly expose those passwords, users must be vigilant about safeguarding their credentials. The prompt can also take you to your Password Manager page , where you can do a comprehensive review of your saved passwords.

Passwords 95

Passwords Authentication Accountability Password Management 95

SC Magazine

MAY 7, 2021

Google announced that it will automatically enroll users in multifactor authentication – what they are calling two-step verification. Google will start automatically enrolling users in 2SV if their accounts are “appropriately configured.” Risher adds that users can check the status of their accounts in Google’s Security Checkup.

Authentication 89

Authentication Passwords Password Management Mobile 89

Krebs on Security

AUGUST 30, 2022

The missives asked users to click a link and log in at a phishing page that mimicked their employer’s Okta authentication page. Those who submitted credentials were then prompted to provide the one-time password needed for multi-factor authentication. Image: Cloudflare.com. 2, and Aug. ” On July 28 and again on Aug.

Mobile 299

Mobile Phishing Authentication Accountability 299

eSecurity Planet

SEPTEMBER 30, 2021

Underground services are cropping up that are designed to enable bad actors to intercept one-time passwords (OTPs), which are widely used in two-factor authentication programs whose purpose is to better protect customers’ online accounts. By using the services, cybercriminals can gain access to victims’ accounts to steal money.

Authentication 113

Authentication Social Engineering Phishing Banking 113

Duo's Security Blog

MAY 4, 2023

Our documentary, “ The Life and Death of Passwords ,” explores with industry experts the history of passwords, why passwords have become less effective over time, and how trust is established in a passwordless future. The problems with passwords Chrysta: Why was passwordless needed in the first place?

Passwords 70

Passwords Authentication DNS Technology 70

Malwarebytes

MARCH 29, 2024

Cybercriminals use MFA bombing to break into accounts that are protected by multi-factor authentication (MFA). MFA normally requires a user to enter a six-digit code sent by SMS, or generated by an app, or to respond to a push notification, when they enter a username and password.

Passwords 121

Passwords Accountability Mobile Authentication 121

Identity IQ

JULY 3, 2023

How to Detect and Respond to Account Misuse IdentityIQ As digital connectivity continues to grow, safeguarding your online accounts from misuse is becoming increasingly crucial. Account misuse can result in alarming repercussions, including privacy breaches, financial losses, and identity theft.

Accountability 52

Accountability Identity Theft Passwords Social Engineering 52

Anton on Security

OCTOBER 12, 2022

This is my completely informal, uncertified, unreviewed and otherwise completely unofficial blog inspired by my reading of our fourth Threat Horizons Report ( full version ) that we just released ( the official blog for #1 report , my unofficial blog for #2 , my unofficial blog for #3 ).

Cybersecurity 246

Cybersecurity Malware Accountability Authentication 246

SecureWorld News

MARCH 10, 2021

GitHub announced a security update due to a bug causing issues with the authentication of sessions. On March 2, GitHub received an external report of anomalous behavior for their authenticated GitHub.com user session. This would give them the valid and authenticated session cookie for another user. How did GitHub fix the issue?

Authentication 79

Authentication CSO Accountability Engineering 79

Duo's Security Blog

OCTOBER 4, 2023

No matter how many letters, numbers, or special characters you give them and no matter how many times you change them, passwords are still @N0T_FUN! Using strong passwords and a password manager 2. Enabling multi-factor authentication 3. Held in October, each week there will be a different focus on a key behavior: 1.

Password Management 97

Password Management Passwords Authentication Social Engineering 97

Malwarebytes

OCTOBER 9, 2023

On Friday October 6, 2023, 23andMe confirmed via a somewhat opaque blog post that threat actors had "obtained information from certain accounts, including information about users’ DNA Relatives profiles." It works because users often use the same password for multiple websites. It's good in theory but fails in practice.

Passwords 129

Passwords Accountability Scams Social Engineering 129

Malwarebytes

SEPTEMBER 20, 2021

In a recent blog Microsoft announced that as of September 15, 2021 you can completely remove the password from your Microsoft account and use the Microsoft Authenticator app, Windows Hello, a security key, or a verification code sent to your phone or email to sign in to Microsoft apps and services. A long time coming.

Passwords 86

Passwords Accountability Authentication Phishing 86