3 ms·
Having MFA as a rule of thumb in an application is good, but it is also assumed we continue to use passwords. I personally preferred offering a passwordless so
by gemanor 3y ago
Having MFA as a rule of thumb in an application is good, but it is also assumed we continue to use passwords. I personally preferred offering a passwordless solutions that includes MFA in it than bringing MFA to the picture and keeping the less secured way to authentication alive.
Also, an advanced authorization system could take into factor some vectors that traditionally was belonged to MFA and create a better UX with advanced security.
- mooreds 3y agoYes, passwordless is great, whether you are talking about magic links or passkeys. While we are waiting for them to get more adoption, making sure you allow (or require) users to set up additional factors of authentication is a good idea. > Also, an advanced authorization system could take into factor some vectors that traditionally was belonged to MFA and create a better UX with advanced security. Tell me more...
- gemanor 3y agoAgree, the adoption is the key here. Regarding AuthZ, dynamic authorization layers that combine policy as code and synchronization engines such as OPAL[1] can make the authentication session smarter and more dynamic to multiple factors. Think of AuthZ layer that combines session geolocation, IP, fingerprints, etc. that enquires every time a new vector needed for the authorization action. 1 https://github.com/permitio/opal https://github.com/permitio/opal
- mooreds 3y agoAh, zero trust by another name. Sure, makes sense. Agree that level of continuous authorization makes sense. Defense-in-depth to the max.