Internet infrastructure company Cloudflare says the same attackers that went after Twilio also sent Cloudflare employees malicious SMS messages with links to phishing sites dressed up as an official company website. Despite employees at both companies taking the bait, Cloudflare said attackers were unable to snatch the full logon credentials of its workers because the company’s second layer of authentication isn’t time-limited one-time codes. Instead, every employee at the company is issued a FIDO2-compliant security key from a vendor like YubiKey. Although the attackers siphoned the credentials, the hard key authentication requirement stopped them from snatching a soft token that fooled employees otherwise would have entered into the phishing site.


More

Wall Street Journal: How to pass on your passwords when you die

Apple, Google and Meta Platforms are among the tech companies that provide digital-legacy tools to…

Read More →

Deutschlandfunk: The end of passwords

The alternative to passwords is to be launched as early as the end of the…

Read More →

TechRadar: You’ve heard passwordless sign-ins are coming. But what is FIDO? And why does it matter?

Senior Director of Marketing at FIDO Alliance, Megan Shamas, shares insights into the background behind…

Read More →