You listened to your IT guy and finally accepted that you need to use Multi Factor Authentication (MFA) for your important accounts. Fine. You even (reluctantly) installed the Authenticator app on your phone. Grrr. I know, it’s a pain.
You are minding your own business; you are not even close to a computer… or maybe you are, but you are not trying to access your account. Your phone beeps or vibrates; the screen tells you that the authenticator app wants you to confirm that the login was you. What do you do?
Change your password.
That’s right folks, you change your password. You do not wait or delay or hope it will go away. Someone somewhere just tried to authenticate as you, and they entered the correct password. Remember the one that you were convinced nobody would ever guess because nobody even remembers your favourite song from 1992 – it was a guilty pleasure after all, and nobody even knew that!
They got it.
I have both written and spoken at length about the dangers of social engineering, and how hackers can ask you a series of seemingly harmless questions and then figure out your password. Well folks, I have news for you… there are other ways to get it, and in the day of Artificial Intelligence (AI) and Generative Pretrained Transformers (GPT) it is much harder to keep our secrets safe.
There is a school of thought that says when using MFA, you do not need to change your passwords on a regular basis. That is a perfectly fair belief. If not after seventy days, when do you have to change them? When there is even a hint or suspicion that someone (either human or otherwise) has compromised them. This is one of those cases.
Am I saying that it is certain that the unexpected MFA prompt is absolute proof that your passwords have been compromised? I am not… but it is absolutely an Indicator of Compromise (IoC). Why take the risk? Change your password, and don’t just add a number at the end of it. That song wasn’t that good anyways. Don’t pass di dutchie pon di lefthand side until you have changed your passwords to something completely unrelated to Musical Youth.
(And if you do not understand what the references are in the last paragraph then get off my lawn!)
Leave a Reply