Researchers detail a phishing campaign by Iran-linked hackers targeting US government officials that bypassed SMS-based 2FA protections in Gmail and Yahoo Mail
eg so you don't have to use the key every time you log on from the same computer at a known IP address. But if anything's unusual you do. Sensible thread http://twitter.com/... Elad Strohmayer / @eladstr : An impressive (yet not surprising) @AP exposé: an #Iranian hacking group targeted #US Treasury officials, high-profile defenders, detractors & enforcers of the #IranDeal, Arab atomic scientists, Iranian civil society figures & DC think tank employees. http://www.apnews.com/... Jake Williams / @malwarejake : Going after private email is an extremely effective tactic. The last two US administrations have had officials running private email servers. From the Clinton email server investigation, we know classified data ended up on the server. I'd bet Gmail has terabytes of classified 1/n http://twitter.com/... Zeynep Tufekci / @zeynep : People: get a security key for your Gmail, Facebook, Insta, Github—whatever you want to protect. *Especially* if you are a high-level target. Regular 2FA, including authenticator, can be phished. SMS can be redirected. (Security key how-to on next tweet). http://arstechnica.com/... http://twitter.com/...