Most orgs I work at there is another Matthew Martin & the help desk confuses them constantly. If the auth system can't distinguish between two people of the same name, then a social engineering attack only requires knowing the *name* of the account you wish to highjack.
Active directory, two-factor auth, encrypted passwords with punctuation, my ass.
♡ 0 ↻ 0