image credit: pxhere
For years, enterprise IT and security operations have been told they need to advance beyond texting short numeric strings in plain text and calling it meaningful Multi-Factor Authentication (MFA) or even just Two-Factor Authentication (2FA). It is stunning how many enterprises still cling to that entry-level security sham, even knowing how subject it is to man-in-the-middle attacks.
As for the oft-cited defense that, “it’s better than having no MFA at all,” I am not so sure. It provides false comfort to enterprise users that they have meaningful security.
Comments are closed.
