Uber investigating breach of its computer systems
I think it&#x27;s worth repeating: at this point, MFA that is not based on Webauthn (<a href="https:&#x2F;&#x2F;webauthn.guide&#x2F;#about-webauthn" rel="nofollow">https:&#x2F;&#x2F;webauthn.guide&#x2F;#about-webauthn</a>) should be considered dangerously insecure. Uber almost certainly enforces MFA for remote access; I strongly suspect we&#x27;ll end up hearing that it was successfully provided during the authentication step (update: screenshots on Twitter appear to confirm this). As we saw in the case of the 0ktapus campaign, a sufficiently-skilled attacker will simply proxy the MFA calls to the real identity provider in real-time, the user none the wiser.<p>Webauthn, however, binds the authenticator to the domain and port, and requires https as the scheme. If a user gets phished, they cannot be compromised: the phisher&#x27;s domain will not match and any Webauthn authentication challenge would fail.<p>So if your workplace is letting you authenticate with SMS codes, push notifications to an app, or 6-digit codes generated by an authenticator app&#x2F;hardware device, you need to start banging on pots and pans up your reporting chain to get your security team the support they need to make Webauthn + FIDO2 hardware tokens or Webauthn + Mac Touch ID happen.