Account takeover, MFA bypass and what actually stops them
Recent attacks and CVEs that target sign-in, explained for developers and IT teams — and an honest account of where two-factor authentication helps and where it does not.
· 7 min read
Number matching stops MFA fatigue. Phishing proxies still get through
How push-bombing attacks work, why number matching and a biometric prompt stop them, and why AitM kits like Tycoon2FA still get through.
MFA fatigueNumber matchingPhishingRead· 8 min read
Two-factor for SSH and sudo on Ubuntu: what it stops, and the 2025 CVEs it doesn’t
regreSSHion, the sudo chroot bug, the PAM/udisks chain: which ones two-factor stops, which only patching fixes, and how to add push 2FA to SSH and sudo.
SSHsudoLinuxCVERead· 6 min read
Stop sending SMS codes: SIM swaps, SS7 and what CISA now says
CISA says not to use SMS as a second factor, and UK SIM swaps rose 1,055% in 2024. What to use instead, and how to move your users off SMS codes.
SMSSIM swapTOTPRead· 6 min read
The Authy API has reached End of Support: how to migrate push and TOTP 2FA
Twilio’s Authy API is closed to new customers and slated for deprecation. Your options, and a step-by-step plan to move push and TOTP 2FA.
AuthyMigrationPush 2FARead