Why TOTP Won’t Cut It (And What to Consider Instead)

Shows how a CAPTCHA that can be solved once and replayed fails to stop brute force - a password was cracked on the 86th try - and lists checks like one-time use and session binding.

Shows how an attacker with domain credentials can request an RSA Emergency Access Tokencode from the self-service console and brute force the numeric PIN, turning recovery features into a 2FA bypass.

The first post in an anti-scraping series lays out five core principles: require authentication, enforce rate limits, lock down account creation, cap data volume, and return generic error messages.

Sectigo CTO Jason Soroko joins the Agent of Influence podcast to explain why MFA is the bare minimum of IAM, covering symmetric vs. asymmetric secrets and digital certificate best practices.

With PyPI now supporting TOTP and WebAuthn, Trail of Bits shares lessons from adding 2FA to Warehouse: second factors must be something you have or are, SMS is broken, and WebAuthn beats TOTP.

Wiz, a founding participant in CISA's Secure by Design initiative, details its pledge progress—no-cost SAML 2.0 SSO, mandatory MFA for direct logins, no default passwords, and least-privilege service accounts.