6 ms·
Forgive the naive question, but would 2FA completely mitigate this attack, assuming that the org trying to access a key vault did not have access to the 2FA dev
by tomtoise 9y ago
Forgive the naive question, but would 2FA completely mitigate this attack, assuming that the org trying to access a key vault did not have access to the 2FA device?
- xxkylexx 9y agoNo. This article describes an attack where the user has already gained access to the encrypted database, which assumes they have already subverted 2FA.
- tomtoise 9y agoAh. Thanks. So the idea is to stop the user before they get that far, I suppose. Doesn't this hark back to "If the attacker has local access, it's already game over"?
- annabellish 9y agoNot really, the databases are designed to be effectively public information. The security comes from the encryption, not OS-level file permission controls!
- jezclaremurugan 9y agoHas local access plus has a weak master password.