Attacking Google Authenticator

Authelia

The Single Sign-On Multi-Factor portal for web apps, now OpenID Certified™

Kanidm

Kanidm: A simple, secure, and fast identity management platform

Compromising online accounts by cracking voicemail systems

Or why you should not rely on automated phone calls as a method to reach the user and reset passwords, 2FA or for any kind of verification. Not unlike SMS-based 2FA, it is currently insecure and can be compromised by the way of its weakest link: voicemail systems

Breaking Password Dependencies: Challenges in the Final Mile at Microsoft

The primary source of account hacks is password spraying (on legacy auth like SMTP, IMAP, POP, etc.), second is replay attack. Takeaway: password are insecure, use and enforce MFA