6 ms·

Microsoft makes me/us do 2FA ~5-20 times a day, doesn't support U2F and implements 2FA in a way that forces you to type a PIN into the phone rather than the oth

Microsoft makes me/us do 2FA ~5-20 times a day, doesn't support U2F and implements 2FA in a way that forces you to type a PIN into the phone rather than the other way around (massive phishing hole they don't seem to care about - sometimes I'll be flooded with 2FA prompts and have no idea which ones were initiated by me or by an attacker). I've joked about writing an app on my phone that would just auto-respond to all the 2FA prompts with my PIN, and have been told that other people actually tried to (or did) implement such an application. Meanwhile I was at a Googler's place a year ago and watched him tap a U2F device on the side of his laptop to complete the second factor. Sigh.

saganus 10y ago
How does MS make you do 2FA 5-20 times a day? You mean you work there and accessing services or tools requires you to do 2FA every time? I hope they are already planning to overhaul that because it does seem like a very cumbersome and insecure way of "securing" accesses.
wesleytodd 10y ago
You are probaly referring to https://www.yubico.com/ https://www.yubico.com/ I just bought one the other day for personal use, pretty cheap, cant say more becuase I have yet to receive it, but I have high hopes.
- kevhito 10y ago
  I've had one for about 6 months that I use for gmail. I like it, easy to set up, works pretty much out of the box, security story seems reasonable, and device is physically pretty sturdy so far. For at least 2 linux boxes I use, I needed to add udev rules for the yubikey. That wasn't immediately obvious and took a few minutes to figure out why it wasn't working.
- pacaro 10y ago
  I'm a fan. It would be nice if there was more support. I can use it on gmail, github, and dropbox. I'm not aware of any other online services that support it (that I use)
mmcconnell1618 10y ago
If you work for Microsoft (I do) that doesn't sound right. There are times when I get 2FA but not often on my work machine. Microsoft employees get a smart card and if your machine has a TPM chip you can create a virtual smart card accessed with a pin or biometric factor like fingerprint or Windows Hello.
- colemickens 10y ago
  I don't use Windows except when interacting with the 15 year-old payroll time entry system. I have nothing nice to say about support for non-Windows users, though most of that is unrelated to 2FA (though supporting U2F would sure be a lot more friendly than proprietary apps that surf on top of the TPM)
  - spyrosg 10y ago
    No a fan of Microsoft systems, but they have GS-API/Kerberos and AD FS 3. Unix users will want SSH key management, but apart from that, Microsoft made efforts to help people spread single sign-on to much of their infrastructure. If your payroll system has a web interface, you can have an applicative firewall in front replay your stored credentials as a hacky SSO (after checking your identity another way, of course).
    - colemickens 10y ago
      The payroll system, as well as security group / mailing list systems are all completely useless in anything but IE (not even Edge). And Kerebos does nothing for these 2FA woes sadly.
userbinator 10y ago
in a way that forces you to type a PIN into the phone rather than the other way around Could you explain more what you mean by this? Presumably it's not typing a phone into a PIN...?
- closeparen 10y ago
  Usually you copy a OTP from the phone to the application you're trying to use.
- pavel_lishin 10y ago
  We use Okta at work, and we can either put in a six-digit code, or we can prompt the webapp to push a request to our phone, and then click "accept" or "deny" (after unlocking the phone, of course.) Okta at least shows which app is requesting permission.
- colemickens 10y ago
  What closeparen said. Normally the phone gives you the PIN and you type it into the application you just signed into. Gives you some amount of assurance that the second-factor is going to the desired party. Instead, MS's 2FA send a notification to your phone where you type in a static, pre-defined PIN. There is no way of knowing what actor or application triggered the 2FA request.

saganus 10y ago

How does MS make you do 2FA 5-20 times a day? You mean you work there and accessing services or tools requires you to do 2FA every time? I hope they are already planning to overhaul that because it does seem like a very cumbersome and insecure way of "securing" accesses.

wesleytodd 10y ago

You are probaly referring to https://www.yubico.com/ https://www.yubico.com/ I just bought one the other day for personal use, pretty cheap, cant say more becuase I have yet to receive it, but I have high hopes.

kevhito 10y ago
I've had one for about 6 months that I use for gmail. I like it, easy to set up, works pretty much out of the box, security story seems reasonable, and device is physically pretty sturdy so far. For at least 2 linux boxes I use, I needed to add udev rules for the yubikey. That wasn't immediately obvious and took a few minutes to figure out why it wasn't working.
pacaro 10y ago
I'm a fan. It would be nice if there was more support. I can use it on gmail, github, and dropbox. I'm not aware of any other online services that support it (that I use)

mmcconnell1618 10y ago

If you work for Microsoft (I do) that doesn't sound right. There are times when I get 2FA but not often on my work machine. Microsoft employees get a smart card and if your machine has a TPM chip you can create a virtual smart card accessed with a pin or biometric factor like fingerprint or Windows Hello.

colemickens 10y ago
I don't use Windows except when interacting with the 15 year-old payroll time entry system. I have nothing nice to say about support for non-Windows users, though most of that is unrelated to 2FA (though supporting U2F would sure be a lot more friendly than proprietary apps that surf on top of the TPM)
- spyrosg 10y ago
  No a fan of Microsoft systems, but they have GS-API/Kerberos and AD FS 3. Unix users will want SSH key management, but apart from that, Microsoft made efforts to help people spread single sign-on to much of their infrastructure. If your payroll system has a web interface, you can have an applicative firewall in front replay your stored credentials as a hacky SSO (after checking your identity another way, of course).
  - colemickens 10y ago
    The payroll system, as well as security group / mailing list systems are all completely useless in anything but IE (not even Edge). And Kerebos does nothing for these 2FA woes sadly.

userbinator 10y ago

in a way that forces you to type a PIN into the phone rather than the other way around Could you explain more what you mean by this? Presumably it's not typing a phone into a PIN...?

closeparen 10y ago
Usually you copy a OTP from the phone to the application you're trying to use.
pavel_lishin 10y ago
We use Okta at work, and we can either put in a six-digit code, or we can prompt the webapp to push a request to our phone, and then click "accept" or "deny" (after unlocking the phone, of course.) Okta at least shows which app is requesting permission.
colemickens 10y ago
What closeparen said. Normally the phone gives you the PIN and you type it into the application you just signed into. Gives you some amount of assurance that the second-factor is going to the desired party. Instead, MS's 2FA send a notification to your phone where you type in a static, pre-defined PIN. There is no way of knowing what actor or application triggered the 2FA request.