2FA in 2020 and Beyond
Evaluates modern two-factor authentication protocols, phishing resistance, and future directions for identity verification.
Summary
Security engineer Kelley Robinson evaluates the evolving landscape of multi-factor authentication (MFA) in the AppSec Village, addressing the persistent security vulnerabilities of SMS-based two-factor authentication [00:14, 05:35]. Robinson outlines why SMS remains highly vulnerable to SIM-swapping, SS7 telecom interception, and credential phishing, despite its widespread commercial use.
The presentation compares alternative authentication factors, analyzing the user experience trade-offs of time-based one-time password (TOTP) authenticator apps and proprietary mobile push notifications [10:44]. Robinson explores emerging attack vectors such as MFA push fatigue, where attackers repeatedly trigger notification prompts to coerce accidental user approvals [10:48]. The talk concludes with strategies for driving user adoption of phishing-resistant hardware security keys based on FIDO2 and WebAuthn standards [15:46, 21:02].
(AI summary — Gemini Flash)
Related talks
OWASP Foundation·30 min
Analysts investigate attack surfaces and defenses concerning AppSec EU 2017 Analysis And Detection Of Authentication Cross Site Request Forgery by Luca Compagna.
Main Stage·34 min
S Pratap Singh · J Lin · D Seetoh
Demonstrates architectural and implementation weaknesses in commercial passkey syncing and WebAuthn relying party implementations.
Payment Village·52 min
Arkadiy Litvinenko
Examines application layer security, transaction signing vulnerabilities, and authentication weaknesses in online banking platforms.