ATKey – 1：Why we need security key and FIDO2?​

targeted phishing attacks (Aug. 2022) against Twilio, Cloudflare and other companies reinforce the need for companies to adapt phishless forms of Multi-factor Authentication (MFA). In these targeted attacks, the phishing kit would immediately relay any captured username and passwords to the attacker, in addition to any provided Time-based One-Time Password (TOTP) MFA codes. The attacker would then quickly leverage the stolen credentials and TOTP codes before they expired. In Cloudflare’s case, they used FIDO2 security keys, instead of TOTP codes, thwarting the attackers.

the attack on July 15, 2020, targeted a small umber of employees through a phone spear phishing attack. This attach relied on a significant and concerted attempt to mislead certain employees and exploit human vulnerabilities to gain access to your internal system. After the hack, The company migrated all of its employees from legacy 2FA using SMS or authenticator apps to fido security keys in less than three months to its entire workforce for accessing internal systems.​