3 ms·
> This feature is not 2FA > anti-ATO ATO [1] is authentication by definition, but again, depending on how it's implemented, not usually the best form. [1] ht
by rasengan 7y ago
> This feature is not 2FA
> anti-ATO
ATO [1] is authentication by definition, but again, depending on how it's implemented, not usually the best form.
[1] https://csrc.nist.gov/glossary/term/authorization-to-operate https://csrc.nist.gov/glossary/term/authorization-to-operate
- andrewflnr 7y agoAuthorization is not authentication, by definition. Furthermore, your link is talking about an entirely unrelated meaning of ATO. I believe tptacek meant it to stand for "account take-over".
- tptacek 7y agoYou're right; that's what ATO means here.
- rasengan 7y agoSame difference. Anti account take over and account authentication, because similar methods would be deployed (i.e., multifactor authentication, heuristic, etc.)
- tptacek 7y agoNo, obviously not.
- akerl_ 7y agoAt risk of pointing out the obvious, ATO (as in Authorization To Operate) has nothing to do with logging in, technical authentication, or technical authorization. An ATO is a piece of paper or equivalent that lets your business deploy a product or solution, primarily used in the government space. It’s a contract that a human/organization signs, not a part of the login process for a computer.