Daniel Miessler

MARCH 24, 2021

Basically, how secure is someone’s current behavior with respect to passwords and authentication, and what can they do to improve? The idea here is for someone in the security community—or really any security-savvy user—to use this visual to help someone with poor password hygiene. How to use this model.

Authentication 363

Authentication Passwords Internet Internet 363

The Last Watchdog

MAY 24, 2022

This is one giant leap towards getting rid of passwords entirely. Perhaps not coincidently, it comes at a time when enterprises have begun adopting passwordless authentication systems in mission-critical parts of their internal operations. Excising passwords as the security linchpin to digital services is long, long overdue.

Authentication 342

Authentication Passwords Banking Digital transformation 342

Schneier on Security

APRIL 1, 2022

FIDO2 multi-factor authentication systems are not susceptible to these attacks, because they are tied to a physical computer. .” Calling the target, pretending to be part of the company, and telling the target they need to send an MFA request as part of a company process.

Authentication 363

Authentication Hacking Passwords 363

Krebs on Security

SEPTEMBER 29, 2021

In February, KrebsOnSecurity wrote about a novel cybercrime service that helped attackers intercept the one-time passwords (OTPs) that many websites require as a second authentication factor in addition to passwords. An ad for the OTP interception service/bot “SMSRanger.”

Passwords 348

Passwords Mobile Authentication Banking 348

Krebs on Security

OCTOBER 13, 2021

A recent phishing campaign targeting Coinbase users shows thieves are getting cleverer about phishing one-time passwords (OTPs) needed to complete the login process. In each case, the phishers manually would push a button that caused the phishing site to ask visitors for more information, such as the one-time password from their mobile app.

Passwords 363

Passwords Phishing Accountability Mobile 363

Security Boulevard

DECEMBER 31, 2024

The FIDO Alliance found in a survey that as consumers become more familiar with passkeys, they are adopting the technology as a more secure alternative to passwords to authenticate their identities online. The post Best of 2024: FIDO: Consumers are Adopting Passkeys for Authentication appeared first on Security Boulevard.

Authentication 105

Authentication Passwords Technology 105

Schneier on Security

FEBRUARY 1, 2023

This is the result of a security audit: More than a fifth of the passwords protecting network accounts at the US Department of the Interior—including Password1234, Password1234!, The audit uncovered another security weakness—the failure to consistently implement multi-factor authentication (MFA). and ChangeItN0w!—were

Passwords 281

Passwords Accountability Authentication Government 281

Schneier on Security

FEBRUARY 19, 2025

It exploits “device code flow,” a form of authentication formalized in the industry-wide OAuth standard. Authentication through device code flow is designed for logging printers, smart TVs, and similar devices into accounts.

Phishing 213

Phishing Authentication Accountability Passwords 213

Krebs on Security

NOVEMBER 12, 2024

The second bug fixed this month that is already seeing in-the-wild exploitation is CVE-2024-43451 , a spoofing flaw that could reveal Net-NTLMv2 hashes , which are used for authentication in Windows environments. Narang notes that CVE-2024-43451 is the third NTLM zero-day so far this year.

Authentication 266

Authentication Engineering Malware Passwords 266

Krebs on Security

SEPTEMBER 22, 2023

The password manager service LastPass is now forcing some of its users to pick longer master passwords. But critics say the move is little more than a public relations stunt that will do nothing to help countless early adopters whose password vaults were exposed in a 2022 breach at LastPass.

Passwords 327

Passwords Encryption Password Management Cryptocurrency 327

Troy Hunt

DECEMBER 7, 2021

He's not a techie (he runs a pizza restaurant), but somehow, we ended up talking about passwords. Change the password to one 1Password automatically generates c. Obviously, he still has a heap of accounts to set decent passwords on, but now he knows the pattern and he can repeat that over and over again.

Passwords 356

Passwords Password Management Banking Accountability 356

Troy Hunt

MAY 27, 2021

Both these announcements are being made at a time where Pwned Passwords is seeing unprecedented growth: Getting closer and closer to the 1B requests a month mark for @haveibeenpwned 's Pwned Passwords. Speaking of natural fits, Pwned Passwords is perfect for this model and that's why we're starting here.

Passwords 363

Passwords Accountability Cybercrime Authentication 363

NetSpi Technical

NOVEMBER 14, 2024

Open cmd.exe and execute PowerShell or PowerShell ISE using the runas command so that network communication authenticates using a provided set of domain credentials. Username domainuser -Password password Note: I’ve tried to provide time stamps and output during run-time, so you know what it’s doing.

Passwords 145

Passwords Risk Data collection Backups 145

The Last Watchdog

JULY 24, 2023

Accessing vital information to complete day-to-day tasks at our jobs still requires using a password-based system at most companies. Today, bad actors are ruthlessly skilled at cracking passwords – whether through phishing attacks, social engineering, brute force, or buying them on the dark web. Some solutions do this today.

Authentication 245

Authentication Passwords Phishing Social Engineering 245

Security Boulevard

JANUARY 22, 2025

Dive deep into the technical fundamentals of Authentication and SSO systems. Learn how HTTP, security protocols, and best practices work together to create robust authentication solutions for modern web applications. The post Authentication and Single Sign-On: Essential Technical Foundations appeared first on Security Boulevard.

Authentication 98

Authentication Passwords 98

Krebs on Security

JANUARY 7, 2025

Lookout researchers discovered multiple voice phishing groups were using a new phishing kit that closely mimicked the single sign-on pages for Okta and other authentication providers. In the first step of the attack, they peppered the target’s Apple device with notifications from Apple by attempting to reset his password.

Phishing 342

Phishing Cryptocurrency Accountability Social Engineering 342

Malwarebytes

FEBRUARY 11, 2025

Of those malicious apps, 5,200 could subvert one of the strongest security practices available today, called multifactor authentication, by prying into basic text messages sent to a device. They dont crack into password managers or spy on passwords entered for separate apps.

Phishing 128

Phishing Passwords Mobile Authentication 128

Schneier on Security

DECEMBER 27, 2023

No passcode fallback is available in the event that the user is unable to complete Face ID or Touch ID authentication. For especially sensitive actions, including changing the password of the Apple ID account associated with the iPhone, the feature adds a security delay on top of biometric authentication.

Authentication 332

Authentication Passwords Accountability 332

Schneier on Security

AUGUST 25, 2022

Here’s a phishing campaign that uses a man-in-the-middle attack to defeat multi-factor authentication: Microsoft observed a campaign that inserted an attacker-controlled proxy site between the account users and the work server they attempted to log into.

Phishing 350

Phishing Authentication Passwords Accountability 350

Daniel Miessler

MARCH 10, 2022

People are starting to get the fact that texts (SMS) are a weak form of multi-factor authentication (MFA). In that post we talked about 8 levels of password security, starting from using shared and weak passwords and going all the way up to passwordless. It completely changes how authentication is done.

Authentication 364

Authentication Phishing Passwords Accountability 364

Schneier on Security

JULY 10, 2024

New attack against the RADIUS authentication protocol: The Blast-RADIUS attack allows a man-in-the-middle attacker between the RADIUS client and server to forge a valid protocol accept message in response to a failed authentication request.

Authentication 294

Authentication Passwords 294

Schneier on Security

JANUARY 9, 2024

The malware captures any PINs and passwords the victim enters to unlock their device and can later use them to unlock the device at will to perform malicious activities hidden from view.

Malware 313

Malware Banking Passwords Authentication 313

Malwarebytes

FEBRUARY 25, 2025

If you find an app from this family or another information stealer on your device, there are a few guidelines to follow to limit the damage: Change your password. You can make a stolen password useless to thieves by changing it. Choose a strong password that you dont use for anything else. Enable two-factor authentication (2FA).

Passwords 145

Passwords Password Management Phishing Authentication 145

Krebs on Security

JANUARY 21, 2022

The site says it sells “cracked” accounts, or those that used passwords which could be easily guessed or enumerated by automated tools. One example is Genesis Market , where customers can search for stolen credentials and authentication cookies from a broad range of popular online destinations.

Hacking 347

Hacking Cybercrime Passwords Authentication 347

Tech Republic Security

DECEMBER 11, 2024

Keepers extensive authentication options and generous discounts make it an alluring password manager to try this year. Read more about it in our full review.

Password Management 152

Password Management Passwords Authentication 152

Krebs on Security

NOVEMBER 21, 2024

The targeted SMS scams asked employees to click a link and log in at a website that mimicked their employer’s Okta authentication page. The bot allowed the attackers to use the phished username, password and one-time code to log in as that employee at the real employer website.

Identity Theft 258

Identity Theft Phishing Cryptocurrency Accountability 258

Adam Shostack

JANUARY 2, 2025

Authentication is more frustrating to your customers when you dont threat model. The bank unexpectedly sent me a temporary password to sign up, and when I did, the temporary password had expired. But then, after I went to reset the password, the bank emailed me a one time code. Recently, I was opening a new bank account.

Banking 130

Banking Passwords Password Management Authentication 130

Malwarebytes

NOVEMBER 4, 2024

In this blog post, we take a look at how criminals are abusing Bing and stay under the radar at the same time while also bypassing advanced security features such as two-factor authentication. Once a victim types their user ID and password, criminals will receive the data immediately.

Engineering 125

Engineering Phishing Banking Authentication 125

eSecurity Planet

FEBRUARY 25, 2025

In a recent cybersecurity development, threat actors exploited weak security practices by targeting Microsoft accounts that lack two-factor authentication (2FA). As discussed on WindowsForum, this “password spray and pray” attack highlights the importance of robust authentication measures.

Passwords 58

Passwords Authentication Accountability Threat Detection 58

Krebs on Security

NOVEMBER 1, 2024

Booking.com said it now requires 2FA , which forces partners to provide a one-time passcode from a mobile authentication app (Pulse) in addition to a username and password. .” The phony booking.com website generated by visiting the link in the text message.

Phishing 267

Phishing Accountability Artificial Intelligence Cybercrime 267

Malwarebytes

MARCH 31, 2025

Use a different password for every account. If you get your username and password stolen on one account you dont want scammers to be able to use it on another. Password managers help you create complex passwords, and they remember them for you. Set up multi-factor authentication on every account you can.

Scams 140

Scams Passwords Accountability Password Management 140

Troy Hunt

AUGUST 30, 2023

The advice to impacted individuals is as follows: Get a digital password manager to help you make all passwords strong and unique If you've been reusing passwords, change them to strong and unique versions now, starting with the most important services you use Turn on multi-factor authentication wherever it's available, especially for important (..)

Phishing 353

Phishing Password Management Passwords Banking 353

Krebs on Security

SEPTEMBER 13, 2023

USDoD claimed they grabbed the data by using passwords stolen from a Turkish airline employee who had third-party access to Airbus’ systems. By stealing these tokens, attackers can often reuse them in their own web browser, and bypass any authentication normally required for that account. Microsoft Corp. government inboxes.

Cybercrime 343

Cybercrime Passwords Authentication Malware 343

Hacker's King

DECEMBER 28, 2024

A compromised password can lead to identity theft and data breaches. To safeguard your Gmail password, you need to adopt a few best practices that will enhance your accounts security and keep cyber threats at bay. If hackers gain access to your Gmail password , they could potentially compromise these connected services too.

Passwords 52

Passwords Identity Theft Accountability Data breaches 52

eSecurity Planet

NOVEMBER 6, 2024

Though cookies themselves don’t steal passwords, they can be hijacked to access sensitive data. They could even conceal dangerous malware in photos or links on secure websites you visit, and a single click can activate the code, even overcoming multifactor authentication. Cookies track users with unique IDs.

Identity Theft 110

Identity Theft Passwords Phishing Accountability 110

Security Affairs

OCTOBER 21, 2024

The Internet Archive was breached again, attackers hacked its Zendesk email support platform through stolen GitLab authentication tokens. HIBP confirmed that the stolen archive had 31M records, including email address, screen name, bcrypt password hash, and timestamps for password changes.

Internet 127

Internet Internet Data breaches Authentication 127

Duo's Security Blog

APRIL 3, 2025

Users dont like passwords and logging in, period. MSPs should like passwords even less since, according to Gartner , 40% of all help desk calls are related to password resets. While this may avoid authentication fatigue, it certainly risks and may even violate some security standards.

Authentication 52

Authentication Passwords Risk VPN 52