MFA is Not the Holy Grail of Security

Originally published at ewright3.com In January 2024, the SEC's official X account was hijacked. Attackers posted a fake Bitcoin ETF approval announcement, briefly moving markets. The Securities and Exchange Commission, the agency that writes the rules on public company cybersecurity disclosures, couldn't protect its own phone number . The compromise mechanism was a SIM swap. No sophisticated exploit. No zero-day. Just a phone call to a carrier. The SEC account had MFA (multi-factor authenticati