5 ms·
So this freaked me out! A week ago I went passwordless with my Microsoft account; which required setting up Microsoft Authenticator. While I was there, I re-eva
by discardedrefuse 5y ago
So this freaked me out! A week ago I went passwordless with my Microsoft account; which required setting up Microsoft Authenticator. While I was there, I re-evaluated my entire MFA setup:
* I had already setup Authy OTP codes, which I was actively using. So I left that alone.
* I had already setup an external email. So I left that alone.
* I setup Microsoft Authenticator for the first time.
* I added a pair of FIDO U2F YubiKeys.
* I generated and backed up an account recovery code.
* I REMOVED my cell phone number because SMS is not secure.
* I did NOT look at my aliases because I wasn't aware that was even a thing. It's not part of the Security Dashboard.
Here's what worked: I've been able to sign in with Microsoft Authenticator on my phone, the YubiKeys on supported browsers, and receive codes at my external email if neither of aforementioned devices are available. I have noticed that, even though the Authy OTP code is still listed on my Security Dashboard, I can't trigger a prompt for that code. This isn't a huge deal, since both Authy and Microsoft Authenticator are on my phone.
In reaction to your post, I went and checked out my aliases. My phone number was NOT in there. The only alias I have is my primary Microsoft email. I don't know if my phone number ever was in there. Perhaps it was, and when I deleted my number from the Security Dashboard it also deleted from the aliases? I don't know. I do know that there is no phone number listed under my Account Info or Security Dashboard.
Thanks for this post. It reminds me just how vested we are on certain accounts; accounts that can disappear in an instant. I hope you get your issues resolved!
- temp8964 5y agoI know SMS is not 100% secure, but you can easily get SMS recovered if you lose your phone. How do you cover Authenticator if you lose your phone? I always keep both.
- discardedrefuse 5y agoMicrosoft Authenticator and Authy both backup to the cloud. I also have a non-Microsoft email linked to receive 2FA codes, as well as 2 hardware security keys, and an account recovery code. I think I'm covered.
- bmitc 5y agoMicrosoft Authenticator is one of the authentication apps that can backup online.
- moepstar 5y agoLike, what could possibly go wrong...
- FabHK 5y agoYou can easily set up Authy, for example, to be multi-device. Then hope that you don’t lose your computer, phone, and tablet simultaneously.
- wsc981 5y agoSome sites give recovery codes that you have to store somewhere and that you should be able to use if you lose access to an Authenticator app.
- GoOnThenDoTell 5y agoSomething about printed recovery codes makes me think of passwords on postit notes
- 3np 5y agoYou can always back up the secret ID on, for example, a piece of paper, if you don’t want to use a TOTP app with sync/backups (there are several, both proprietary and FLOSS)
- beached_whale 5y agoif using normal TOTP apps, print the QR code and store it somehwere secure. It’s a risk, but it’s one part of the puzzle needed and it reduces a more likely risk of being locked out.
- walterbell 5y ago> It reminds me just how vested we are on certain accounts; accounts that can disappear in an instant. In some countries, digital identity accounts are now required to buy food, https://txti.es/covid-pass/images https://txti.es/covid-pass/images. Will government IT systems have fewer glitches than FAANG digital identity systems?
- Semaphor 5y ago> In some countries, digital identity accounts are now required to buy food Which? Because Lithuania allows the account-less EU Covid pass, so it’s not them. Not even to mention that the pass is not required for essential stores, so I’m not quite sure how you got to "required to buy food"
- walterbell 5y agoAren't passes required to access restaurants? What's the democratic process by which taxpayers consented to the exclusion of those same taxpayers from the cities and society funded by their taxes? There are many questions about the lack of science behind these policies of exclusion, even if we ignore the tragic history of previous ill-conceived attempts to segregate society based on identity, digital or otherwise. If we're going to partition society along "essential" lines, should the same be done to identify "essential" taxes? A printed paper/card that is uniquely associated with a digital database is still a digital identity, and subject to a wide range of glitches, including proof of biometrics to access a portal where the card can be printed.
- burnished 5y agoLol, you think the only place to get food is at a restaurant
- walterbell 5y agoDo you know how much global business is conducted in restaurants? It's practically part of the workplace for sales professionals. Exclusion from restaurants means exclusion from work for some people. Zoom is not a replacement for business meetings that benefit from face-to-face negotiation. Remember what history teaches about "people making lists" - it never stops with one list, or one group of list-makers. Today's list-maker can be tomorrow's list-member. There is a reason that most segregated societies have failed.