MFA
11 articles with this tag
FortiBleed (FortiGate credential leak, about 74,000 devices): not a new vulnerability, so admin and VPN passwords must be changed
FortiBleed is the large-scale leak and misuse of administrator and SSL VPN credentials for FortiGate, Fortinet's firewall and VPN appliance. On June 18, 2026, CISA warned that credentials associated with about 74,000 devices had leaked. On June 19, Fortinet said it is not a new vulnerability and that the activity likely involves reuse of credentials from previous incidents plus brute-forcing of devices with weak passwords and no multi-factor authentication. On June 23, JPCERT/CC issued an alert saying it had confirmed that the data includes information related to Japanese companies. On October 6, the FBI and the U.S. Secret Service warned that the activity continues, that some administrators have been locked out of their devices, and that the access has been used as an entry point for ransomware. Upgrading to fixed firmware does not invalidate leaked passwords. This site's conclusion: if you run FortiGate, change admin and VPN passwords, enforce multi-factor authentication, take the management interface off the internet, and remove the legacy SHA-256 copies of admin passwords.
DentaQuest Data Breach: An MFA Code Handed Over to a Scammer, and What Members Should Do
DentaQuest, a US dental and vision benefits administrator, says unauthorized individuals accessed data on its network between May 17 and May 20, 2026. Its filing with the Washington State Attorney General says a social engineering attack tricked a single employee into providing credentials and a multifactor authentication code. The data includes names, addresses, dates of birth, Social Security numbers, member and health plan numbers, Medicaid and Medicare numbers, and dental or vision health information. Data elements vary by individual. The company told the Washington AG on August 3, 2026 that it was aware of more than 27.4 million people nationwide. An SSN cannot be changed, so members should freeze their credit at all three bureaus, get an IRS IP PIN and watch benefit statements. For organizations, the lesson is that any MFA a person can read out or type in can also be handed over; phishing-resistant MFA (passkeys, FIDO2 security keys) and a help desk that verifies callers are what prevent this.
Canvas (Instructure) Data Breach: Course Enrolments and Messages Leaked — What Students, Teachers and Schools Should Do
According to Instructure, the company behind the Canvas learning management system (LMS), unauthorized activity was detected on April 29, 2026, and usernames, email addresses, course names, enrollment information and messages were exfiltrated. The company says the fields involved are not designed to store passwords, dates of birth, health information, Social Security numbers, financial information, grades or disciplinary records. On May 7 the same actor used another vulnerability to alter pages shown after login. The field list looks mundane, but an email address plus which classes someone takes is exactly what a convincing school-themed scam needs, and messages are free text, so anything people typed there may be included. Verify contact only through your school's official channels; school IT should register security contacts, review logs, require MFA for admins and keep course data backed up outside the LMS.
How do people store passwords? What the data shows — and the safe way
Representative surveys show ~54% rely on memory, ~33% write passwords on paper, and only ~36% use a dedicated password manager — with ~25% reusing passwords. Meanwhile Verizon's DBIR found credential compromise involved in ~38% of breaches and that ~74% of passwords in breach data were reused. In short: the most popular storage habits are the easiest for attackers to exploit. The safe basics are a manager (unique password per site) plus passkeys/MFA on your key accounts.
Security for the AI era: the basics to lock down now (priority checklist)
AI mostly amplifies attacks on EXISTING weaknesses (unpatched CVEs, reused passwords, exposed secrets) rather than inventing new ones — found automatically, fast, at scale. So the best preparation is locking down the basics in the right order: CVE patching + dependency monitoring, stop password reuse + MFA, remove exposed secrets, least privilege, shrink the public surface, logs/IOCs, backups.
What is phishing? The types of attack, and defenses more reliable than spotting it
Phishing impersonates a trusted party to lure you to a fake login page and steal credentials or data (or run malware). It targets human judgment rather than a software flaw, and is the number-one entry route for ransomware and breaches. Modern adversary-in-the-middle (AiTM) phishing relays even one-time codes to the real site in real time, so SMS/app MFA can be defeated. The reliable defense isn't 'spotting it' but mechanisms: domain-bound phishing-resistant MFA (passkeys/security keys), going to the official site directly instead of clicking links, and email authentication (SPF/DKIM/DMARC).
Choosing MFA the right way: what 'phishing-resistant' means, and why SMS is weak
MFA uses different factor categories. Manually entered codes can be relayed through phishing; SMS also depends on control of the phone number. Prefer phishing-resistant methods such as passkeys or FIDO2 security keys for important accounts, check user-verification requirements, and protect recovery methods too.
Are password managers safe? How they work, cloud vs local, and how to choose
A password manager helps you use a strong, unique password for each service. Zero-knowledge encryption is designed to protect contents even if encrypted data leaks from the provider, but safety also depends on master password strength, encryption settings, and device security. Use MFA to prevent unauthorized logins, and choose cloud or local by use.
The security baseline for indie devs and small operators: standard controls in priority order
The baseline isn't 'all equally important.' This site's priority order: 1) admin accounts, domain and email (MFA), 2) secrets and code, 3) the app itself, 4) patch, detect, recover. With finite time, fill it top-down. Most serious breaches come not from novel attacks but from a gap in these basic controls.
Smartphone security basics: protecting the one device that holds your passwords, payments, and ID
A phone concentrates 2FA, email, banking, and ID into one device, so losing it affects many services (a single point of failure). The most effective protection isn't a security app: (1) a strong lock + short auto-lock (the passcode is the encryption key); (2) automatic OS/app updates; (3) official store + permission review; (4) set up remote lock/wipe in advance; (5) keep a backup of your 2FA. iOS/Android already encrypt and sandbox by default.
Is storing your passwords in Google Drive safe? How to keep them properly
Keeping passwords in a plaintext Google Doc/Sheet is dangerous: one Google account becomes the single point of failure for every password — account takeover, a rogue connected app, or phishing leaks them all at once. The safest option is a dedicated password manager (contents stay encrypted even when synced). If you must use Drive, store only an encrypted vault file and put phishing-resistant MFA on the account.