mfa-and-step-up

仓库创建 2026年7月26日最近提交 18 小时前SkillHot 收录 4 小时前

▸ 精选理由

强调真实攻击场景下的因素选择和强制策略。

这个 Skill 做什么

介绍 MFA 与 step-up 认证的选择、强度与实现注意事项。

帮你决定和实现真正能挡住攻击的多因素认证（MFA）和对敏感操作的 step‑up 验证。适合在新增或审查登录/重要操作流程时使用，会讲哪种因子更抗真实攻击、哪些实现会被客户端绕过（别用易被劫持的 SMS），以及如何在服务器端强制执行和测试验证链路是否不能被跳过。

▸ 展开 SKILL.md 英文原文

Use when adding or reviewing multi-factor and step-up authentication — choosing factors that resist real attacks and enforcing them so they can't be bypassed.

研究检索多因素认证Step-up抗绕过通用

Stars

Forks

仓库内 Skill

积累中

7 日增星

安装 / 使用

给你的 Agent 一句话（通用）

帮我安装这个 skill：https://raw.githubusercontent.com/jihedbfr-art/cyber-skills/main/skills/11-identity-and-access-management/05-mfa-and-step-up/SKILL.md

或 curl 直取 SKILL.md

curl -fsSL "https://raw.githubusercontent.com/jihedbfr-art/cyber-skills/main/skills/11-identity-and-access-management/05-mfa-and-step-up/SKILL.md"

SKILL.MD 节选查看完整文件 ↗

## Purpose

MFA is the single most effective control against credential theft — but only if the factor resists the attack you face and the enforcement can't be skipped. A poorly implemented second factor (SMS, or a check the client can bypass) gives false confidence. This skill covers choosing factors, adding step-up for sensitive actions, and testing that the enforcement actually holds.

## When to use it

Designing authentication for any app that matters, hardening after a credential-stuffing scare, or reviewing an existing MFA implementation for bypasses. Pairs with the authentication-testing and session-management skills.

## Choosing factors (weakest to strongest)

- **SMS / email OTP**

via SKILL·HOT · 数据来自 GitHub 公开信息 · 原文版权归作者所有