Comments URL: https://news.ycombinator.com/item?id=45043522

Points: 4

# Comments: 0

"The table below provides more detail on how iCloud protects your data when using standard data protection or Advanced Data Protection."

https://support.apple.com/en-us/102651

Which service is it? Do they ever use that password?

If I were used to signing in with a passkey, I'd find a password prompt suspicious. While the average person might not, it's also possible they would have forgotten the password entirely. There are other services that force TOTP even with hardware keys enrolled. Technically they can be phished, but it would not be successful in all cases.

Unfortunately, varying behavior and support for multifactor protocols (along with risky reset flows) makes it hard to give blanket recommendations.

If an adversary can successfully phish someone, they can often also trick them into providing TOTP codes or approving push notifications. However, TOTP remains significantly better than the alternatives, as it prevents credential stuffing attacks and SMS-related compromises while potentially limiting any account breach to a single session.

The NSA and CIA are neither able nor authorized to defend all privately-owned critical infrastructure. While concerns about agency oversight are warranted, I can assure you that spying on the population is not their top priority. It's abundantly clear that foreign threats aren't confined to their own geographies and networks. That can't be addressed without having the capability to look inward.

Secure by Design is an initiative led by CISA, which frequently shares guidance and threat reporting from the NSA and their partners. Unfortunately, they also can't unilaterally secure the private sector overnight.

These are difficult problems. Critical infrastructure owners and operators need to rise to the challenge we face.

I don't have a personal opinion about the company; however, email is important enough that it's worth considering edge cases and future scenarios.

That's a strategic capability that very likely requires multiple attack chains, not a single exploit. For Western countries, cost is probably the least significant factor in deciding to use it.

One would want to be certain that option is available, but only when absolutely necessary. Using it on a random Tuesday would take that particular option off the table forever. Best case scenario, Russia discovers the means by which the attack was carried out. Worst case, they retaliate with nuclear weapons.

Globally, I believe there are only a few countries capable of executing such a plan.

That said, I still use "Nanoblock" webcam covers and monitor for when either the camera or microphone are activated.

[1] https://support.apple.com/guide/security/hardware-microphone...

Security companies attribute activity based on their observations. ESET- a Slovakian company- is no exception.

https://www.nsa.gov/press-room/cybersecurity-advisories-guid...

I've highlighted advisories that may give you some perspective, listed in chronological order:

Iranian Cyber Actors’ Brute Force and Credential Access Activity Compromises Critical Infrastructure Organizations

Russian Military Cyber Actors Target U.S. and Global Critical Infrastructure

North Korea Cyber Group Conducts Global Espionage Campaign to Advance Regime’s Military and Nuclear Programs

PRC MSS Tradecraft in Action

Were you able to solve the challenge at the end?