Why Multi-Factor Authentication is Becoming Easier to Bypass—and How to Strengthen Your Security

Adversary-in-the-middle attacks are becoming more frequent. In 2022, one group stole over 10,000 credentials from 137 organizations, causing significant issues for companies like Twilio.

However, content delivery network Cloudflare managed to escape these attacks unharmed. Their secret? They use Multi-Factor Authentication (MFA) based on WebAuthn. This standard makes their systems highly resistant to these types of attacks.

Why is WebAuthn so effective? First, it links credentials directly to the specific URL they protect. For instance, credentials from https://accounts.google.com won’t work if someone tries to log in through a fake site, like https://accounts.google.com.evilproxy[.]com. This means that even if the attacker intercepts credentials, they can’t use them at a different site.

Second, WebAuthn requires authentication to occur on the victim’s device. The credentials are also linked to that specific device. Because of this, an attacker can’t use them from their own device, making phishing attacks much more difficult.

Phishing remains one of the toughest security challenges for businesses and users alike. While traditional MFA methods, such as one-time passwords or push notifications, add some protection, they are increasingly vulnerable to newer proxy-in-the-middle attacks.

WebAuthn also offers different forms of MFA, like passkeys stored on phones or USB devices like Yubikeys. Many websites now support this technology, making it easier for users to adopt stronger security measures. It’s worth noting that while U2F, an earlier standard, also prevents these attacks, WebAuthn provides enhanced flexibility and security.

Experts emphasize that adopting robust security standards, like WebAuthn, is essential in today’s digital landscape. With the rise of cyberattacks, organizations need to stay ahead by investing in stronger protection methods and educating users about the risks of phishing.

As the cybersecurity landscape evolves, staying informed is crucial. For more on the importance of secure authentication, you can explore resources from the National Institute of Standards and Technology (NIST).

Source link