Chances are your online accounts are secured with multi-factor authentication (MFA). Typical methods might be approving a login from your phone or getting a text message with a code to sign in. You might think that two layers of defense (a password and code, for example) are good enough to make sure nobody other than you gets access to your account. But attackers have come up with clever ways to bypass MFA. The main problem with traditional MFA is that it requires you to transmit a \u201csecret\u201d (a password, a code, etc.) that can be phished or intercepted.<\/p>\n
One method an attacker might use to get access to your account is to convince you to give up your password by making a fake login page. This fake page could look identical to a real website\u2019s login page with differences only visible to someone with a sharp eye. Some clues might be inconsistent fonts, the website\u2019s logo being off, or the URL having a small typo, called typosquatting (the letters \u201crn\u201d can look like the letter \u201cm\u201d). Sometimes people don\u2019t catch these inconsistencies and that\u2019s not their fault. A skilled attacker can make them very easy to miss. If you try to log in to your real account on this fake website, all of your data simply gets sent to the attacker. The fake page passes what you type to the real login page in real time, so when the real site asks you for your MFA code, the fake page asks for it too, and the attacker gets that as well.<\/p>\n
Another method is called push bombing<\/strong>. This method assumes that an attacker already has your password. The attacker would attempt to log into your account repeatedly, each time sending an approval request to your phone. They hope that if they keep spamming you with these requests, eventually you will grow tired of the notification and tap \u201capprove\u201d just to make it stop. If you ever notice getting any unexpected login approval requests to your LUC account, you should immediately <\/strong>head to Loyola\u2019s self-service password reset<\/a> to change your password.<\/p>\n The modern solution is a passkey. You might\u2019ve used passkeys before to log in to your Apple or Google account and now Loyola is implementing passkeys to keep your LUC account more secure than ever. The difference between passkeys and other traditional MFA methods is that you don\u2019t give up any secrets when logging in with passkeys. Very simply, a passkey is like a lock and key pair. When you set one up, a key is created and Loyola\u2019s login system gets a matching lock. When you sign in, your key never leaves your device. Your device just needs to prove it has the passkey and that\u2019s only if the website is the real one. Each passkey is registered per-site so a typosquatted webpage doesn\u2019t even get a chance to ask for your passkey, making phishing pages useless. With passkeys, there is no push notification to approve so push bombing isn\u2019t viable for attackers anymore.<\/p>\n