,
3 tweets,
1 min read
Read on Twitter
Important security research from Google on the effectiveness of various kinds of 2FA that got a bit buried this crazy week. Among key findings, SMS 2FA was still 76% effective against highly "targeted" phishing attacks and 99% good vs. "bulk" phishing.
security.googleblog.com/2019/05/new-re…
security.googleblog.com/2019/05/new-re…
Other interesting findings:
-Google's app-based 2FA (using its verification prompts) was 90% effective against targeted phishing and 99% effective against bulk phishing
-Both forms of 2FA were 100% effective against "automated bot" credential stuffing & spraying attacks
-Google's app-based 2FA (using its verification prompts) was 90% effective against targeted phishing and 99% effective against bulk phishing
-Both forms of 2FA were 100% effective against "automated bot" credential stuffing & spraying attacks
-So too actually was just presenting some kinds of "knowledge-based challenges" like asking the user to verify phone number or last sign-in location. But those ranged from much less effective to ineffective vs. phishing attacks.
