4 ms·

People don't like having to type in their password each time they come back to the computer. Especially if their password is required to be fairly long and comp

People don't like having to type in their password each time they come back to the computer. Especially if their password is required to be fairly long and complex, which can become tedious to have to type in constantly during the day. If you want users to adopt secure practices then you have to lower the amount of friction. Adding a fingerprint reader or some other kind of biometrick unlocking capability would probably help. A better example: I think on macOS the system can be setup to automatically lock and unlock by wearing an Apple Watch. The users aren't the ones that have to be trained, it's the flawed security practices that need to be fixed.

c0nsumer 6y ago
Look into Windows Hello for Business. It's very nice in the enterprise for all of this. Native facial recognition or fingerprint, and various other factors can be added.
- bombcar 6y ago
  Causes all sorts of hell with Remote Desktop, however. But it’s the right direction. For those with a Mac and an Apple Watch you can make the watch automatically lock and unlock based on Bluetooth distance.
  - c0nsumer 6y ago
    How so? In my experience you are prompted to use it, and you can click and use standard credentials if desired. I deployed WHfB at our $LARGE_ENTERPRISE and opted against using BT RSSI as a trusted signal because it's just too unpredictable. Probably because the Windows space is much more varied, but an RSSI that'd work for one device at ~8' away would fail to lock another when two cube rows away. Meaning, we knew users would start to depend on it, but it wouldn't work as they thought. Thus, still policies of locking machines, it's now just easier to unlock. (And arguably more secure because now less password typing means far fewer chances for keyloggers to get network-usable credentials.)
    - bombcar 6y ago
      I enabled Hello on my VM Windows 10 Enterprise and then was unable to connect via Remote Desktop from my Mac - so it didn't have single sign-on but it wouldn't fall back to anything I could use. So I disabled it and now it's happy.
      - c0nsumer 6y ago
        Thanks. I'll test this in the morning. AFAIK it works for us, but I don't know for sure. Which RDP client were you using? And did you disable the password provider (leaving just the WHfB factors)? And you had full Windows Hello for Business? (This one: https://docs.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-identity-verification https://docs.microsoft.com/en-us/windows/security/identity-p...) Or, were you using standard Hello? (The two are similarly named, but are quite different under the covers.)

c0nsumer 6y ago

Look into Windows Hello for Business. It's very nice in the enterprise for all of this. Native facial recognition or fingerprint, and various other factors can be added.

bombcar 6y ago
Causes all sorts of hell with Remote Desktop, however. But it’s the right direction. For those with a Mac and an Apple Watch you can make the watch automatically lock and unlock based on Bluetooth distance.
- c0nsumer 6y ago
  How so? In my experience you are prompted to use it, and you can click and use standard credentials if desired. I deployed WHfB at our $LARGE_ENTERPRISE and opted against using BT RSSI as a trusted signal because it's just too unpredictable. Probably because the Windows space is much more varied, but an RSSI that'd work for one device at ~8' away would fail to lock another when two cube rows away. Meaning, we knew users would start to depend on it, but it wouldn't work as they thought. Thus, still policies of locking machines, it's now just easier to unlock. (And arguably more secure because now less password typing means far fewer chances for keyloggers to get network-usable credentials.)
  - bombcar 6y ago
    I enabled Hello on my VM Windows 10 Enterprise and then was unable to connect via Remote Desktop from my Mac - so it didn't have single sign-on but it wouldn't fall back to anything I could use. So I disabled it and now it's happy.
    - c0nsumer 6y ago
      Thanks. I'll test this in the morning. AFAIK it works for us, but I don't know for sure. Which RDP client were you using? And did you disable the password provider (leaving just the WHfB factors)? And you had full Windows Hello for Business? (This one: https://docs.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-identity-verification https://docs.microsoft.com/en-us/windows/security/identity-p...) Or, were you using standard Hello? (The two are similarly named, but are quite different under the covers.)