This is expensive and companies that do this still get phished. The industry standard advice seems to be to train staff to recognise phishing attacks. They were responsible for Hillary Clinton’s campaign emails being hacked.Įven if you are a Republican you are still not safe, as Sarah Palin’s email account was hacked via a phishing attack.ĭespite what the victims will tell you, these attacks are not sophisticated and they don’t require “state sponsorship”.

Phishing attacks were responsible for John Podesta’s email getting hacked. OTP and phishingĪccording to research by Google, phishing is by far the most common way for an online account to be compromised. However, it makes the most common form of account compromise only marginally more difficult.

Read short numeric code from OTP generatorĮnabling 2FA on your online accounts is a huge improvement on using static passwords alone.

Traditional OTPs protect against password reuse, weak passwords and credential leakage.Ī user’s login procedure using a traditional OTP is usually something like this: Two-Factor Authentication with One-Time Passwords This post is part of a series on using Yubikeys to secure development whilst pair-programming on shared machines. There is one gotcha with an easy workaround: the SDKs don't usually support the login part of the SSO flow, and sometimes don't support it at all (terraform comes to mind).If you’re amassing a plethora of user accounts that require two-factor authentication (2FA) and let’s face it, you should, then you’ll be pleased to learn how you can use a USB Yubikey to avoid having to type in as many one-time-passwords (OTPs). This setup allows you to offload MFA handling to your main IdP with the added bonus of using the same method of authentication, possibly integrated into your OS (for example if using Windows Hello / AzureAD).Īt work, we use Azure AD as the IdP for AWS SSO and it works fairly well, aside from Azure's crappy (inexistent) support of security keys outside of Windows. Otherwise, you'll have to pay for the IdP.

If you already have a compatible one, you can use it at no additional cost. The service itself is free but requires an identity provider. In may not be available in the region you're mostly using but that's not necessarily an issue. You may want to look into AWS Single Sign-On.

Aws u2f