4 ms·
> But how have we increased safety when my Team/Outlook phone app requests that I click "approve" on a different app? By ensuring that whoever signs into the a
by jsnell 6y ago
> But how have we increased safety when my Team/Outlook phone app requests that I click "approve" on a different app?
By ensuring that whoever signs into the account has at least two distinct factors: the password and the trusted phone with the authenticator app. One thing you know, one thing you have. Perfect. (Depending on your phone's settings around biometric unlock, it might be even the trifecta: one thing you know, one thing you have, and one thing you are).
Let's imagine we implemented your suggestion of requiring the login to be on a different device than the authenticator app. What threat model does this protect against? An attacker who has your password and the unlocked phone will just sign in from a different device with the password, and then use the authenticator app from the phone. The only people you're protected against are those who do not have any access to another device than the stolen phone.
- stormbrew 6y agoGP is saying they're using an authenticator running on the computer they're logging in on (they alt-tab to it from the browser). So they have two factors in the sense of "something you know" vs. "something you have" but in this case the something they have is the same device.
- jsnell 6y agoYes, I understand that. And like I explained, there is nothing wrong with it being the same device.
- sriku 6y agoI have trouble with the MS signin for work. Looks like blocking third party cookies (which safari seems to do) makes this nearly impossible (or incredibly inconvenient) to use.
- ec109685 6y agoThe something you know these days is just stored in your password manager, protected by your phone’s passcode most likely, so it all ends up being “something you have”.
- will4274 6y agoYour phone's passcode is something you know.