3 ms·
MFA could have largely been unnoticed had there been large scale adoption of client side SSL/TLS certificates. This would have required a better UX on the brows
by u801e 5y ago
MFA could have largely been unnoticed had there been large scale adoption of client side SSL/TLS certificates. This would have required a better UX on the browser side and an account creation process that made creating a CSR locally, transmitting it, receiving the cert and storing it transparent.
Then as long as both the username/password and certificate authentication were required, then password reuse wouldn't matter.
- throwaway581294 5y agoYou could go one step further and just put a pin in with the cert or no pin at all and just have seamless logins everywhere. Assuming you are using a physical cert token.
- u801e 5y agoThen you lose one factor which is the username/password. If someone managed to get your hardware token and was able to brute force the PIN (if there was a PIN set), then they could log into any of your accounts. By requiring both, an adversary would not be able to log in unless they had the certificate and the username/password. Using one of the two would not be sufficient.
- deleted 5y ago[deleted]
- freitasm 5y agoThat's how passwordless works with Yubikeys on Office 365 and Microsoft Accounts.