5 ms·

I once had a coworker who refused to install a two-factor code generator (such as Google Authenticator, but there a dozens of alternatives) on his personal phon

I once had a coworker who refused to install a two-factor code generator (such as Google Authenticator, but there a dozens of alternatives) on his personal phone. I told him that he could generate codes any other way he likes, but the personal phone would be easiest. He wouldn't have lost his job but he wouldn't be able to gain production access, which required two-factor codes. He grudgingly installed a two-factor app. I'm sympathetic to the idea of "don't make me install stuff on my phone", but when it can be one of several apps, and the sole purpose of the app is retain a cryptographic key and run some hashes on it... I lose most of my sympathy. I suppose it'd be nice if that employer (I no longer work there) provided a device to generate the two factor codes, but I can understand why they don't.

Lev1a 6y ago
> I suppose it'd be nice if that employer (I no longer work there) provided a device to generate the two factor codes, but I can understand why they don't. I mean... aren't there quite literally devices whose sole purpose is to generate 2FA codes? Something with a form factor similar to a small keyfob? I do know these exist but I've personally never seen one "in the flesh". Also I can only imagine these (as a singular solution for all relevant employees) would probably also be easier to administer than a wild growth of different 2FA apps, most likely on different OSs and even different versions of those OSs, while over the years the churn of employees means the variation gets ever larger.
- unreal37 6y ago
  I used to have to carry around an RSA keyfob to be able to deploy code to production! I've had a few of those at different jobs! https://en.wikipedia.org/wiki/RSA_SecurID https://en.wikipedia.org/wiki/RSA_SecurID I've never had a job that required "Google Authenticator" on my personal phone. I guess I stopped working for other people long before that became the main 2fa method. That might be a step too far.
ev1 6y ago
I find this totally reasonable, especially since you can pick what app you want to install, and _it's actually useful for stuff outside of work_. For example, Okta Verify or Duo I would absolutely demand a separate phone for paid for by work - they are remotely monitorable/controllable more than local hashing. But you should be generating TOTP codes for your personal accounts too!
- tolbish 6y ago
  The principle of the issue is requiring personal property for the job when there are well-known, safer alternatives such as the RSA SecureID. What happens if your phone freezes or completely dies? What if an attacker who can access the first factor of authentication can remotely access your phone? Why risk it?
  - ev1 6y ago
    What happens when your RSA SecurID token dies, the office is closed, no one can provision you a new one unlike a TOTP?
    - tolbish 6y ago
      Your RSA SecureID being the point of failure is much more rare and much more harmless than your phone being the point of failure.
    - _carbyau_ 6y ago
      Then work supports it. However great or poor that they do is up to them. If I let my phone simply run out of battery... Well, it is my phone. I can if I want to. If I don't upgrade for 6 years and nothing accepted supports my version of OS... Well, it is my phone. I can if I want to. As soon as you make my phone a part of your business, it is no longer my phone.
- asdff 6y ago
  At least with duo you can have it just call a number. No app needed. Which is hillarious to see in a hospital setting. Get duo push from the desktop, the handset installed next to the desktop is often the one to ring. It stops being two factor when you can control both factors with one butt in one seat.
zorrolovsky 6y ago
> but when it can be one of several apps, and the sole purpose of the app is retain a cryptographic key and run some hashes on it... I lose most of my sympathy. I can't see how having a choice of apps changes anything. An employer shouldn't be able to demand an employee to use personal property for work purposes against the employee's will. That's unreasonable, unacceptable and ethically wrong in my opinion.
moftz 6y ago
Where I've worked, they will hand out RSA-style tokens that constantly generate new codes if you don't have a phone or don't want to install an app on your personal phone. There are even tokens out there that will totally replace any Authenticator-compatible app since the token is programmable.
renewiltord 6y ago
It's very easy to solve this. Give your dudes a Yubikey and get them to use that. It becomes their responsibility to secure the Yubikey. Almost everything supports the new ones. And if they don't, use Okta for SSO and Okta supports that.
qntty 6y ago
> but I can understand why they don't. And why is that? I don't know of any good reason besides not wanting to spend a trivial amount of money. I sometimes like to leave my phone at home when I go to work because I want to separate work from personal life. I would probably leave a job that required me to have my phone on me for work.
deleted 6y ago
[deleted]

Lev1a 6y ago

> I suppose it'd be nice if that employer (I no longer work there) provided a device to generate the two factor codes, but I can understand why they don't. I mean... aren't there quite literally devices whose sole purpose is to generate 2FA codes? Something with a form factor similar to a small keyfob? I do know these exist but I've personally never seen one "in the flesh". Also I can only imagine these (as a singular solution for all relevant employees) would probably also be easier to administer than a wild growth of different 2FA apps, most likely on different OSs and even different versions of those OSs, while over the years the churn of employees means the variation gets ever larger.

unreal37 6y ago
I used to have to carry around an RSA keyfob to be able to deploy code to production! I've had a few of those at different jobs! https://en.wikipedia.org/wiki/RSA_SecurID https://en.wikipedia.org/wiki/RSA_SecurID I've never had a job that required "Google Authenticator" on my personal phone. I guess I stopped working for other people long before that became the main 2fa method. That might be a step too far.

ev1 6y ago

I find this totally reasonable, especially since you can pick what app you want to install, and _it's actually useful for stuff outside of work_. For example, Okta Verify or Duo I would absolutely demand a separate phone for paid for by work - they are remotely monitorable/controllable more than local hashing. But you should be generating TOTP codes for your personal accounts too!

tolbish 6y ago
The principle of the issue is requiring personal property for the job when there are well-known, safer alternatives such as the RSA SecureID. What happens if your phone freezes or completely dies? What if an attacker who can access the first factor of authentication can remotely access your phone? Why risk it?
- ev1 6y ago
  What happens when your RSA SecurID token dies, the office is closed, no one can provision you a new one unlike a TOTP?
  - tolbish 6y ago
    Your RSA SecureID being the point of failure is much more rare and much more harmless than your phone being the point of failure.
  - _carbyau_ 6y ago
    Then work supports it. However great or poor that they do is up to them. If I let my phone simply run out of battery... Well, it is my phone. I can if I want to. If I don't upgrade for 6 years and nothing accepted supports my version of OS... Well, it is my phone. I can if I want to. As soon as you make my phone a part of your business, it is no longer my phone.
asdff 6y ago
At least with duo you can have it just call a number. No app needed. Which is hillarious to see in a hospital setting. Get duo push from the desktop, the handset installed next to the desktop is often the one to ring. It stops being two factor when you can control both factors with one butt in one seat.

zorrolovsky 6y ago

> but when it can be one of several apps, and the sole purpose of the app is retain a cryptographic key and run some hashes on it... I lose most of my sympathy. I can't see how having a choice of apps changes anything. An employer shouldn't be able to demand an employee to use personal property for work purposes against the employee's will. That's unreasonable, unacceptable and ethically wrong in my opinion.

moftz 6y ago

Where I've worked, they will hand out RSA-style tokens that constantly generate new codes if you don't have a phone or don't want to install an app on your personal phone. There are even tokens out there that will totally replace any Authenticator-compatible app since the token is programmable.

renewiltord 6y ago

It's very easy to solve this. Give your dudes a Yubikey and get them to use that. It becomes their responsibility to secure the Yubikey. Almost everything supports the new ones. And if they don't, use Okta for SSO and Okta supports that.

qntty 6y ago

> but I can understand why they don't. And why is that? I don't know of any good reason besides not wanting to spend a trivial amount of money. I sometimes like to leave my phone at home when I go to work because I want to separate work from personal life. I would probably leave a job that required me to have my phone on me for work.

deleted 6y ago

[deleted]