3 ms·

Sounds like your organisation has just limited the 2FA options in the auth settings. Hardware keys are supported on Teams, along with software phones (that hav

by Closi 5y ago

Sounds like your organisation has just limited the 2FA options in the auth settings. Hardware keys are supported on Teams, along with software phones (that have a static number / extension) and a linked desktop/mobile app. In fact FIDO2 hardware keys like Yubikey are part of what Microsoft refers to as ‘passwordless’ - see https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-authentication-passwordless https://docs.microsoft.com/en-us/azure/active-directory/auth... I assume you aren’t an admin on the account just because otherwise you could just disable 2FA properly rather than disabling it with a weird twillio workaround, although I have to give you credit, this is the most effort I have seen someone put in to subvert a security policy.

dheera 5y ago
Yeah I'm not an admin on the account and have no control over it. An app doesn't work for me either, When I have a big rack-mounted immobile desktop that should if anything BE the 2FA device, if anything, not a 6-inch easily-stealable device.
- hirsin 5y ago
  Which gets you back to the problem OP has - trusting that device enough to make it a secure root of trust. Windows lets you do it, so do Android and iOS. But your admin, maybe not (or you're not on windows, which is more likely I guess).
eikenberry 5y ago
FIDO2 keys still lack one of the main features of physical keys that make them great... you can have many copies. FIDO2 makes it impossible to copy a key, saying instead to always use multiple FIDO2 keys in all cases. This pretty much kills the idea for it to replace passwords as no one is going to set up 3+ keys for every site they login to. So it will only be of use to lock your password manager where registering multiple keys would be feasible. You could use it to unlock a single oauth account that you could then use to login to other places. Problem with those systems is trading privacy for convenience.
- dheera 5y ago
  It's a feature, not a bug, but in order for it to be a feature, every service should accept multiple FIDO2 keys. Many services get this utterly wrong, including AWS, while Google, Github, and Facebook notably have good implementations. Why it's a feature: if you lose a key you can log in with another key and disable the lost key. If you lose your house key you have no option but to change the lock, if you want to be safe from thieves.
  - eikenberry 5y ago
    That feature will kill the standard outside of mandated (corporate/gov) use cases. There's no way I want to have to worry about registering 2-3 FIDO2 keys with every site I currently use passwords for. And there's no way I'd trust Google's (or any other company) OAuth to be my master login for every site.. assuming they all take OAuth and that Google accepted multiple FIDO2 keys. IMO it's a mis-feature and will keep it from eliminating passwords. In fact I think it will only reinforce password use as the one good case for it is to lock your password manager.
- stavros 5y ago
  > FIDO2 keys still lack one of the main features of physical keys that make them great... you can have many copies. There is absolutely nothing stopping you from making a copiable FIDO key, and, in fact, most Bitcoin hardware wallets are just that, since they come with FIDO apps and you can copy the keys over to another hardware key. Or, you can write some Arduino firmware to make your own, copiable, FIDO2-compatible key.
  - eikenberry 5y ago
    Do you know of any major players that support this? I'm only really aware of Yubico's offering and they don't have a model that allows copying. Thanks for raising this point though. Lack of copy-ability is more an implementation issue than a problem with the standard.
    - stavros 5y ago

by Closi 5y ago

dheera 5y ago

Yeah I'm not an admin on the account and have no control over it. An app doesn't work for me either, When I have a big rack-mounted immobile desktop that should if anything BE the 2FA device, if anything, not a 6-inch easily-stealable device.

hirsin 5y ago
Which gets you back to the problem OP has - trusting that device enough to make it a secure root of trust. Windows lets you do it, so do Android and iOS. But your admin, maybe not (or you're not on windows, which is more likely I guess).

eikenberry 5y ago

FIDO2 keys still lack one of the main features of physical keys that make them great... you can have many copies. FIDO2 makes it impossible to copy a key, saying instead to always use multiple FIDO2 keys in all cases. This pretty much kills the idea for it to replace passwords as no one is going to set up 3+ keys for every site they login to. So it will only be of use to lock your password manager where registering multiple keys would be feasible. You could use it to unlock a single oauth account that you could then use to login to other places. Problem with those systems is trading privacy for convenience.

dheera 5y ago
It's a feature, not a bug, but in order for it to be a feature, every service should accept multiple FIDO2 keys. Many services get this utterly wrong, including AWS, while Google, Github, and Facebook notably have good implementations. Why it's a feature: if you lose a key you can log in with another key and disable the lost key. If you lose your house key you have no option but to change the lock, if you want to be safe from thieves.
- eikenberry 5y ago
  That feature will kill the standard outside of mandated (corporate/gov) use cases. There's no way I want to have to worry about registering 2-3 FIDO2 keys with every site I currently use passwords for. And there's no way I'd trust Google's (or any other company) OAuth to be my master login for every site.. assuming they all take OAuth and that Google accepted multiple FIDO2 keys. IMO it's a mis-feature and will keep it from eliminating passwords. In fact I think it will only reinforce password use as the one good case for it is to lock your password manager.
stavros 5y ago
> FIDO2 keys still lack one of the main features of physical keys that make them great... you can have many copies. There is absolutely nothing stopping you from making a copiable FIDO key, and, in fact, most Bitcoin hardware wallets are just that, since they come with FIDO apps and you can copy the keys over to another hardware key. Or, you can write some Arduino firmware to make your own, copiable, FIDO2-compatible key.
- eikenberry 5y ago
  Do you know of any major players that support this? I'm only really aware of Yubico's offering and they don't have a model that allows copying. Thanks for raising this point though. Lack of copy-ability is more an implementation issue than a problem with the standard.
  - stavros 5y ago