Make MFA More Resilient
summary
Claims that most MFA is phishable and that average solutions have about 10–11 attack vectors are supported with hands-on review of roughly 160 MFA types and demos of proxy tools like evil proxy that automate man‑in‑the‑middle theft. FIDO‑enabled authentication cuts out those proxy attacks, while push prompts still succeed about 30% of the time in social engineering tests. Recommended fixes: phishing‑resistant protocols, threat‑model disclosure, secure SDLC, crypto agility, rate limiting, and richer user prompts to report abuse.
AI-written summary · about
chapters (13)
- 0:00Introduction and speaker background
- 1:03Why MFA needs to be resilient
- 3:52Network session hijacking explained
- 8:28Stopping man-in-the-middle attacks
- 11:39Push-based MFA vulnerabilities
- 14:30Secure development for MFA vendors
- 16:36Threat modeling and transparency
- 19:03Common MFA attack methods
- 21:51Default security settings matter
- 23:12Protecting shared secrets
- 24:15Crypto agility for future threats
- 25:17Rate limiting and secret expiration
- 26:02Final recommendations and Q&A
related talks
38mAnatomy of the Attack: The Rise and Fall of MFA
45mMFA: Stories that make you go 'Huh?'
47mBreaking the Next Factor – Live Multi-Factor Authentication (MFA) Hacking
42mBreaking the Next Factor - Evil will pwn you LIVE tonight
49mThe Death of Conventional MFA: How AiTM Attacks Are Changing the Game
40mPurple Team Auth: Hacking & Bypassing MFA Systems, and How to Armor Up
34mWhat does ”MFA” mean?
51mMobile MFA Madness: Mobile Device Hygiene and MFA Integrity Challenges