27
TfL requires in-person password resets for 30,000 employees after hack
(www.bleepingcomputer.com)
c/cybersecurity is a community centered on the cybersecurity and information security profession. You can come here to discuss news, post something interesting, or just chat with others.
THE RULES
Instance Rules
Community Rules
If you ask someone to hack your "friends" socials you're just going to get banned so don't do that.
Learn about hacking
Other security-related communities !databreaches@lemmy.zip !netsec@lemmy.world !cybersecurity@lemmy.capebreton.social !securitynews@infosec.pub !netsec@links.hackliberty.org !cybersecurity@infosec.pub !pulse_of_truth@infosec.pub
Notable mention to !cybersecuritymemes@lemmy.world
But why in-person? Surely the priority should be resetting passwords quickly, and doing it in-person is far from quick.
A password has nothing to do with validating your identity, it's merely about authentication. Authentication and authorization are completely separate concepts. They should be resetting authentication to limit chance that an outside attacker can use compromised credentials, and then perhaps re-verifying identities separately for people with access to critical systems first.
Resetting passwords in-person sounds terrible. I use a password manager, so I would be more likely to make a bad password than a good one if I have to do it in front of someone in an interview.
Maybe they’re handing out FIDO2 hardware tokens during the in person meeting.
Yeah, that would be nice. But I honestly doubt it.