David Bombal #564: Hackers can bypass Your MFA In 2026 (And How To Stop It)
Mar 23, 2026
Rob Allen, Senior ThreatLocker rep and cybersecurity expert, explains why SMS MFA and reused passwords are risky. He outlines how attackers use reverse-proxy cookie theft and SIM swapping to bypass protections. The conversation covers authenticator apps, hardware keys, zero trust cloud access, proxying Office 365 traffic, and locking down internal networks with deny-by-default approaches.
AI Snips
Chapters
Transcript
Episode notes
Use Multi-Factor Authentication Everywhere
- Use multi-factor authentication because reused or leaked passwords alone let attackers access accounts across sites.
- Rob Allen explains passwords leak often and 2FA limits damage from breaches and reused credentials.
Block Browser Extensions And Disable Saved Passwords
- Treat browser extensions and saved browser passwords as high-risk and block them in business environments.
- ThreatLocker treats extensions like executables and prevents saving passwords in browsers to stop stealers.
Memorize Passwords For Critical Accounts
- For ultra-critical accounts, memorize passwords instead of storing them anywhere to avoid centralized compromise.
- Rob Allen's company requires portal and Office 365 passwords to be memorized and never stored in managers.