Chances are your online accounts are secured with multi-factor authentication (MFA). Typical methods might be approving a login from your phone or getting a text message with a code to sign in. You might think that two layers of defense (a password and code, for example) are good enough to make sure nobody other than you gets access to your account. But attackers have come up with clever ways to bypass MFA. The main problem with traditional MFA is that it requires you to transmit a “secret” (a password, a code, etc.) that can be phished or intercepted.
One method an attacker might use to get access to your account is to convince you to give up your password by making a fake login page. This fake page could look identical to a real website’s login page with differences only visible to someone with a sharp eye. Some clues might be inconsistent fonts, the website’s logo being off, or the URL having a small typo, called typosquatting (the letters “rn” can look like the letter “m”). Sometimes people don’t catch these inconsistencies and that’s not their fault. A skilled attacker can make them very easy to miss. If you try to log in to your real account on this fake website, all of your data simply gets sent to the attacker. The fake page passes what you type to the real login page in real time, so when the real site asks you for your MFA code, the fake page asks for it too, and the attacker gets that as well.
Another method is called push bombing. This method assumes that an attacker already has your password. The attacker would attempt to log into your account repeatedly, each time sending an approval request to your phone. They hope that if they keep spamming you with these requests, eventually you will grow tired of the notification and tap “approve” just to make it stop. If you ever notice getting any unexpected login approval requests to your LUC account, you should immediately head to Loyola’s self-service password reset to change your password.
The modern solution is a passkey. You might’ve used passkeys before to log in to your Apple or Google account and now Loyola is implementing passkeys to keep your LUC account more secure than ever. The difference between passkeys and other traditional MFA methods is that you don’t give up any secrets when logging in with passkeys. Very simply, a passkey is like a lock and key pair. When you set one up, a key is created and Loyola’s login system gets a matching lock. When you sign in, your key never leaves your device. Your device just needs to prove it has the passkey and that’s only if the website is the real one. Each passkey is registered per-site so a typosquatted webpage doesn’t even get a chance to ask for your passkey, making phishing pages useless. With passkeys, there is no push notification to approve so push bombing isn’t viable for attackers anymore.
If you want to learn how to set up passkeys for your Loyola account, check out this page to get all the info. A couple minutes of setup helps keep your account more secure than it ever has been before. Do yourself a favor!