3 ms·
NASA has had 2FA for over a decade for internal users, RSA dongles initially and PIV cards now (there was something about JPL and the fingerprinting requirement
by mcguire 5y ago
NASA has had 2FA for over a decade for internal users, RSA dongles initially and PIV cards now (there was something about JPL and the fingerprinting requirement, though). They have taken steps recently to get rid of passwords entirely, although legacy systems are a problem (like OpenShift).
The down side is that accessing a server requires a patched Putty from Centrify and about 27 configuration steps that are documented nowhere.
- dralley 5y agoOpenShift isn't a legacy system, it's a commercially supported distribution of Kubernetes. That's about as close to "new hotness" as you're going to find in government. Unless you mean they're stuck on a version from 5+ years ago, which is believable, but hardly OpenShift's fault.
- mcguire 5y agoI mean that password authentication is all our installation supports.
- 3pt14159 5y agoIn 2001 I worked on a project for some of the federal agencies that used remote biometrics for authentication in addition to password use. I'm not sure if it was safe from replay attacks, but still. It wasn't that the feds didn't know how to make things secure, it's just that the workers in the civilian side of the government didn't really understand the threats and didn't prioritize security. Edit: Not to say everywhere in the non-civilian side of the government is secure. It isn't. Just that there are pockets of it that are better hardened that we could just wholesale copy.