Hacker News Reader

>No MFA protects against social engineering (no, not even ____ - don't try to convince me).

Certain MFAs can protect against more types of attacks than others. You covering your head in the sand when people point that out doesn't change that fact but merely indicates you prefer feeling right to being right.

>as I remember the security team being somewhat averse to them

So you're saying that the security team was averse to the thing that would have prevented this hack? And that means we shouldn't put blame on them?

Oh, cloud-based MFA. Dream stuff where you SaaS can reauthenticate at any time, and it just sends a request to the users, without having to rely on them to initiate anything. No idea what could go wrong with that. /s

> this could happen to any company (yes, it could, even yours - don't try to convince me otherwise)

There's a lot of cognitive dissonance in discussion around this story IMO. Nowadays I assume everyone has been or will be pwned, because no breech surprises me anymore. Any small gap can and will be exploited, and as organisations grow the surface area only gets larger and larger. The only way to truly secure data is to not put it on the internet from the jump. For every breach that's published, there's likely a dozen that we never find out about.

OneLogin is fine and all, but why not protect your OneLogin with a hardware key?

> No MFA protects against social engineering

That's true - some kinds of social engineering cannot be prevented by technical means. BUT hardware keys prevent an entire class of extremely common attacks that every other form of MFA is vulnerable to. It would have prevented the method of compromise used here.

Any company not using FIDO/WebAuthn in 2022 is behind on best practices.

> Yubikeys were phased out early on

What security team on earth would be against these?

Wasn't their decision. Was finance's. Blame them.

Blame greyballing on finance too? It seems unlikely for finance to really own the final call here.

> The last thing they need are knowitalls speculating about how stupid they are on HN

Don't you know that sh*tting on everyone else and saying that how you could do it with only 5 people are the traditions of HN...