I got my OSCE exam results today. I passed! 🎉 That means it’s time to do a retrospective/review blog post like everyone else I guess. Mine will be a little different than the usual ones though. This won’t be a study guide — there are plenty of those, and especially for the OSCE some of them are practically exam spoilers. Instead I’d like to talk about where I think the OSCP and OSCE courses and exams fit into today’s world. ...
This post originally appeared on blog.securityevaluators.com Two-Factor Authentication (2FA, also known as Multi-Factor Authentication, or MFA) is all the rage these days, and for good reason. Accounts secured by 2FA are much, much harder to compromise than accounts using only a single factor — so much more so that you can — sometimes — get away with an easier to type and remember (and therefore weaker) password when using it. The most common ways of implementing the second factor are SMS and TOTP (Time-Based One Time Password). When SMS is used, the site sends you a short numerical code via SMS after you enter your password, and you type the code into the site to finish proving your identity. SMS is inconvenient (you have to have your phone on you), and more importantly, SMS is insecure and not recommended, so many sites are moving to TOTP codes instead, which involves using an app to generate codes yourself instead of the site sending them to you. There are a variety of apps that you can use to generate these codes, and some password managers do it too — but you have to be careful: your choice of app could weaken the security benefits provided by TOTP. ...
This post originally appeared on blog.securityevaluators.com The security of a 2FA-protected account is much greater than the security of an account protected by only one factor — in theory. In practice, there is more nuance to it than that. For 2FA, you are trusting the server to enforce the 2FA and not be compromised by hackers or compelled by law enforcement to allow them access to your data; meanwhile a service can be configured to use your password in a way that protects even against hackers or law enforcement. Understanding this nuance requires a deeper understanding of how 2FA works and how it does (or doesn’t!) protect your accounts. ...