Light

Episode #965 Quiz

Passkeys vs 2FA
Date: 2024-03-12 | Length: 2.25 hrs | Episode page at twit.tv

About this episode

CERT declined a live-site report despite proof-of-concept RCE against outdated nginx, while VMware patched critical USB virtualization use-after-free flaws enabling guest-to-hypervisor escape. Microsoft’s Friday disclosure coincided with Midnight Blizzard source-code theft and password spraying. Passkeys use asymmetric challenge-response, keep private keys local, and should replace weaker password-plus-MFA fallbacks.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: Why did CERT’s Vulnerability Analysis Team decline to handle the listener’s report about the major enterprise website?

Question 1

Why did CERT’s Vulnerability Analysis Team decline to handle the listener’s report about the major enterprise website?

They only accept reports after public disclosure has already occurred. They believed the proof-of-concept code was too old to be useful. They required a coordinated disclosure package before reviewing any live-site report. They typically avoid handling reports of vulnerabilities in live websites.

Question 2: What mitigation did VMware recommend if immediate patching of the USB controller flaws could not be done?

Question 2

What mitigation did VMware recommend if immediate patching of the USB controller flaws could not be done?

Restrict all guest access to shared folders and clipboard integration. Force all guest VMs to run with reduced memory allocations. Disable nested virtualization across the entire host fleet. Remove VMware USB controllers from affected virtual machines.

Question 3: According to the episode, what data did the Signal version 7 username feature allow users to hide from people who did not already have it saved?

Question 3

According to the episode, what data did the Signal version 7 username feature allow users to hide from people who did not already have it saved?

Their contact list from other Signal users. Their phone number in Signal by default. Their entire Signal account from anyone with their number. Their profile name in all existing chats.

Question 4: What did Meta say third-party messaging providers must use, or at least match, to interoperate with WhatsApp and Messenger under the DMA?

Question 4

What did Meta say third-party messaging providers must use, or at least match, to interoperate with WhatsApp and Messenger under the DMA?

A proprietary Meta encryption library, or no interoperability at all. Post-quantum encryption exclusively, because the DMA requires it. The Signal Protocol, or a protocol with equivalent security guarantees. TLS only, because the proxy layer handles the rest.

Question 5: What was the core security distinction Steve emphasized between Passkeys and traditional password-plus-MFA logins?

Question 5

What was the core security distinction Steve emphasized between Passkeys and traditional password-plus-MFA logins?

Passkeys are safer mainly because they add an extra time-based code at login. Passkeys are safer because the server stores the private key in encrypted form. Passkeys are stronger mainly because they require a longer user-chosen password. Passkeys rely on public-key crypto, so the site never keeps reusable authentication secrets.

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.