Duo's Security Blog

OCTOBER 1, 2022

at the AA level Last-Used Authentication Method – Duo recalls the last-used auth method which gives users one less decision to make and expedites the login workflow How can you update your environment to the new Universal Prompt? Universal Prompt is designed and tested to meet Web Content Accessibility Guidelines (WCAG) 2.1

Authentication 54

Authentication Social Engineering Risk Software 54

Duo's Security Blog

MAY 4, 2023

Today: Nick Steele, research lead at Superlunar, weighs in on the weaknesses of password-based systems, the difference between a traditional login versus a passwordless one, and how WebAuthn is driving passwordless forward. What are the main weaknesses of password-based auth systems that attackers will exploit? What changes?

Passwords 78

Passwords Authentication DNS Technology 78

Security Boulevard

MAY 19, 2022

In April 2022, ThreatLabz discovered several newly registered domains, which were created by a threat actor to spoof the official Microsoft Windows 11 OS download portal. ThreatLabz discovered several newly registered domains spoofing the official Microsoft Windows 11 OS download portal. Login Data. Key points. dat:*wallet*.*:*2fa*.*:*backup*.*:*code*.*:*password*.*:*auth*.*:*google*.*:*utc*.*:*UTC*.*:*crypt*.*:*key*.*;50;true;movies:music:mp3;

Media 60

Media Social Engineering Backups Passwords 60

Duo's Security Blog

JULY 29, 2021

This may take the form of single sign-on (SSO) or federated portals through standard protocols like Security Assertion Markup Language (SAML) and OpenID Connect (OIDC). Passwordless requires support from both your users’ access devices and your SSO portal or federation system. Phase 4: Adopt Passwordless (We are here!)

Authentication 54

Authentication Passwords Accountability Manufacturing 54

Security Boulevard

DECEMBER 21, 2022

While many logs can alert to the fact CBA has been configured, there does not seem to be any way whatsoever to differentiate between logins performed with a password versus those performed with a certificate. User B has the “Auth Policy Admin” role which can enable CBA in the tenant. While this is true for the “v1.0”

Authentication 52

Authentication Passwords Risk Engineering 52