5 ms·
Typical Microsoft that the last option for which MFA options are allowed is two options together: 'Verification code from mobile app or hardware token' — I real
by j0057 5y ago
Typical Microsoft that the last option for which MFA options are allowed is two options together: 'Verification code from mobile app or hardware token' — I really want the phishing-proof hardware token only!
- tialaramex 5y ago"Verification code from hardware token" does not refer to FIDO / WebAuthn phishing proof authentication. It's talking about those little gizmos from outfits like RSA "SecurID" that are essentially an LCD digital clock except they output an OTP value instead of showing a HH:MM display. They're exactly as secure/ not secure as any TOTP authenticator on a smart phone today, but less convenient. Microsoft has a separate, "Preview" capability for FIDO/ WebAuthn that the domain's Administrators need to authorise for particular people or groups. You should definitely use this, but chances are whoever is gatekeeper for it is sure that like SMS is good enough.
- j0057 5y agoThanks for clearing that up. I agree that those are even worse than TOTP. I'm not expecting to see Yubikeys used anytime soon in the largish enterprises that outsource their IT to the lowest bidder and leave the thinking about security to the information security committee. Just explaining that they need to spend 2x$25 for every employee will take at least five years!