Kevin Surace explains how AI-generated spoof sites can trick users into approving 2FA prompts, letting attackers hijack sessions instantly. He proposes a biometric ring that authenticates only when your finger is within three feet of your login device, communicating locally so it can't be relayed remotely.
The 2-factor authentication on your phone right now can be bypassed in seconds. Here's how hackers are doing it. Your MFA, everyone knows what MFA is, or 2FA, your phone codes or whatever, or your auth apps are 100% compromisable every hour and get compromised at large companies. And they get compromised because of 15 different ways to compromise them. The best one is a real-time relay man-in-the-middle attack. Basically what happens is you go to a spoofed site, it's pixel perfect because AI made it. You're logging into your site, your auth app comes up and says, Is it you? You say it is you. None of it was ever you. The real person is getting relayed that information, and you just let the hacker in Russia in, right? So this stops that. This is a biometric product. I have one on my finger right there. There's a ring. That's a ring. We make other form factors. This is a stick you can just leave on your— they're all wireless. Basically, it uses biometrics. It uses your fingerprint, not face, not voice, not usable anymore, as you know from Delphi. So use your fingerprint. You cannot get into your application services, systems, whatever networks without your finger within 3 feet of the logging on computer. So it has to be local, 'cause the things don't speak cellular and Wi-Fi. And to the original domain that you registered at. So there's no way to hack it. It's unhackable. And the CIOs who have rolled this out across their companies, I say, tell me how it's going. He says, finally, Kevin, I can sleep at night. I know if Kevin's in the network, it is Kevin. If Jeremy's in there, it's Jeremy. It cannot not be Jeremy. Unless someone's got a gun to Jeremy's head, it's impossible. It must be Jeremy. It's his finger. He was within 3 feet of log— of the logging-in computer, and he's logging in only to the original domain he registered at.
