Microsoft Authentication Methods vs Evilginx Token Theft (including Microsoft's New Passkeys!)

As security professionals, we're constantly fighting token theft and knowing the methods of authentication that is suspectable to this attack is vital to us winning the war against the bad guys. In this video, we talk about the methods that are phishing resistant including Microsoft's new FIDO2 authenticator app.

Methods we test in this video:

⌚ Really strong passwords!!
⌚ Texting a code to your phone (SMS)
⌚ Microsoft Authenticator app
⌚ Passwordless authentication
⌚ FIDO2 Physical Security Keys
⌚ Microsoft's Passkeys with the Microsoft Authenticator app

Chapters:
0:00 - Intro
0:44 - Really strong passwords
1:12 - Text message to your phone (SMS)
1:53 - Authenticator App Code
3:40 - FIDO2 hardware security key
5:48 - Microsoft Passkey with Authenticator app (preview)
7:00 - Passkey prerequisites

Want to try Microsoft's new passkeys for yourself? Check out the article below where Jan Bakker walks you through the entire process!

Resources:
Jan Bakker's How to guide on passkeys with Microsoft - https://janbakker.tech/get-started-with-passkeys-in-microsoft-365/

SynAckTime - https://synacktime.com