4 ms·

This is the answer to the question “why can’t we get rid of passwords?”

wil421 4y ago
Or you could do the opposite and be like the company I work for. Force everyone to enter an RSA token on every SSO login.
- Aperocky 4y ago
  It doesn't have to be that manual, yubikey etc can just plug and press.
  - wil421 4y ago
    The company I work for has around 250k employees. I’m sure software RSA is going to be drastically less expensive than yubikey. The people making the policies don’t care at all. They are just dotting is and crossing ts.
- cratermoon 4y ago
  Unless your company is in a high-risk security-sensitive business, they shouldn't. Most companies can accept the low risk of only requiring a second factor sometimes. Usually time-based, but also looking at location and device fingerprint. For example, if you normally log in from your laptop at work in one state and then it sees you trying to log in from a computer in another state (maybe you're visiting family?) it should definitely challenge you.
psanford 4y ago
Nah. Azure AD is one of the few IdPs that already supports FIDO2 Discoverable Credentials. You can use Passkeys with it today. You can go passwordless with it today.
- tialaramex 4y ago
  Unfortunately, unless this changed too recently for me to know about it, that feature is default off and labelled "Experimental" or something. So it's difficult (ask me how I know) for someone who knows way too much about this stuff and has implemented it themselves, to explain to "leadership" why they should change that default.
  - psanford 4y ago
    I don't know the details except that we've been using it since early this year. The docs don't make it seem like there's anything particularly complicated with enabling it[0][1]. [0]: https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-authentication-passwordless https://learn.microsoft.com/en-us/azure/active-directory/aut... [1]: https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-authentication-passwordless-security-key https://learn.microsoft.com/en-us/azure/active-directory/aut...
    - tialaramex 4y ago
      It isn't complicated it's just one push button - but it isn't the default and so you're going to need to persuade somebody they should turn it on.
      - psanford 4y ago
        I'm not sure I really follow. In an enterprise setting, giving people the option to opt into fido fine and good, but it isn't going to meaningfully help lower the risk of phishing for the organization as a whole. To address phishing, organizations need to mandate fido and disable all the weaker forms of authn. That means you're still going to have to convince your leadership to buy into the change anyway. You'll also need a decent sized communication and training campaign to move everyone over to the fido auth flow. The technology is the easy part for rolling out fido in the enterprise. The hard part is all the people stuff. (Although this too is getting easier, since a lot of orgs can now roll out fido with existing hardware via platform authenticators.)

Or you could do the opposite and be like the company I work for. Force everyone to enter an RSA token on every SSO login.

Aperocky 4y ago
It doesn't have to be that manual, yubikey etc can just plug and press.
- wil421 4y ago
  The company I work for has around 250k employees. I’m sure software RSA is going to be drastically less expensive than yubikey. The people making the policies don’t care at all. They are just dotting is and crossing ts.
cratermoon 4y ago
Unless your company is in a high-risk security-sensitive business, they shouldn't. Most companies can accept the low risk of only requiring a second factor sometimes. Usually time-based, but also looking at location and device fingerprint. For example, if you normally log in from your laptop at work in one state and then it sees you trying to log in from a computer in another state (maybe you're visiting family?) it should definitely challenge you.

psanford 4y ago

Nah. Azure AD is one of the few IdPs that already supports FIDO2 Discoverable Credentials. You can use Passkeys with it today. You can go passwordless with it today.

tialaramex 4y ago
Unfortunately, unless this changed too recently for me to know about it, that feature is default off and labelled "Experimental" or something. So it's difficult (ask me how I know) for someone who knows way too much about this stuff and has implemented it themselves, to explain to "leadership" why they should change that default.
- psanford 4y ago
  I don't know the details except that we've been using it since early this year. The docs don't make it seem like there's anything particularly complicated with enabling it[0][1]. [0]: https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-authentication-passwordless https://learn.microsoft.com/en-us/azure/active-directory/aut... [1]: https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-authentication-passwordless-security-key https://learn.microsoft.com/en-us/azure/active-directory/aut...
  - tialaramex 4y ago
    It isn't complicated it's just one push button - but it isn't the default and so you're going to need to persuade somebody they should turn it on.
    - psanford 4y ago
      I'm not sure I really follow. In an enterprise setting, giving people the option to opt into fido fine and good, but it isn't going to meaningfully help lower the risk of phishing for the organization as a whole. To address phishing, organizations need to mandate fido and disable all the weaker forms of authn. That means you're still going to have to convince your leadership to buy into the change anyway. You'll also need a decent sized communication and training campaign to move everyone over to the fido auth flow. The technology is the easy part for rolling out fido in the enterprise. The hard part is all the people stuff. (Although this too is getting easier, since a lot of orgs can now roll out fido with existing hardware via platform authenticators.)