3 ms·
I find this totally reasonable, especially since you can pick what app you want to install, and _it's actually useful for stuff outside of work_. For example,
by ev1 6y ago
I find this totally reasonable, especially since you can pick what app you want to install, and _it's actually useful for stuff outside of work_.
For example, Okta Verify or Duo I would absolutely demand a separate phone for paid for by work - they are remotely monitorable/controllable more than local hashing.
But you should be generating TOTP codes for your personal accounts too!
- tolbish 6y agoThe principle of the issue is requiring personal property for the job when there are well-known, safer alternatives such as the RSA SecureID. What happens if your phone freezes or completely dies? What if an attacker who can access the first factor of authentication can remotely access your phone? Why risk it?
- ev1 6y agoWhat happens when your RSA SecurID token dies, the office is closed, no one can provision you a new one unlike a TOTP?
- tolbish 6y agoYour RSA SecureID being the point of failure is much more rare and much more harmless than your phone being the point of failure.
- _carbyau_ 6y agoThen work supports it. However great or poor that they do is up to them. If I let my phone simply run out of battery... Well, it is my phone. I can if I want to. If I don't upgrade for 6 years and nothing accepted supports my version of OS... Well, it is my phone. I can if I want to. As soon as you make my phone a part of your business, it is no longer my phone.
- asdff 6y agoAt least with duo you can have it just call a number. No app needed. Which is hillarious to see in a hospital setting. Get duo push from the desktop, the handset installed next to the desktop is often the one to ring. It stops being two factor when you can control both factors with one butt in one seat.