One Does Not Simply Add MFA
summary
Shows a real incident where SMS-based MFA fails via SIM swap and SS7 interception, cites NIST deprecating SMS since 2016, and points to Uber’s push-notification spam compromise (Sep 15, 2022) as another failure mode. Compares TOTP apps (Authy, Google Authenticator) to hardware U2F/Titan keys, recommends Argon2 or bcrypt for password hashing not DIY schemes, notes Heroku’s May 2022 database leak forced mass resets, and urges exponential backoff with randomness plus make MFA mandatory for admins.
AI-written summary · about
chapters (17)
- 0:00Intro
- 0:41What you will learn
- 1:39Let our journey begin...
- 3:53What was the hacker up to?
- 6:47What is authentication?
- 8:17Why didn't MFA help?
- 8:52Let's travel deeper
- 17:41OTP vs. U2F
- 19:00Secure your account
- 20:16now let's put a twist on our story
- 24:12Back to security basics
- 32:01Password hash encryption
- 35:50DIY or buy
- 40:18Make it easy on your users
- 43:54MFA is a requirement not optional
- 44:45Outro
- 44:55Q&A
