5 ms·

Impossible if your customers are enterprise.

by seanthemon 3y ago

pnpnp 3y ago
Weird. My fortune 100 company doesn’t use SMS for 2FA.
- kristofferg 3y ago
  It is still very common for business clients of all sizes, in all industries (even critical infra) to request 2FA via SMS. Good for the company you work for that they dont :)
  - yosito 3y ago
    When they request it, they should receive pushback. SMS 2FA is a bad business decision with potentially severe consequences for customers.
    - cbzoiav 3y ago
      "We recommended you went for X and listed SMS security problems as the reasons - here is the email chain" You need to cover your ass, but you don't want to actively push back and risk losing the sale.
- throwaway2037 3y ago
  I assume that all of Fortune 500 (minus tech majors) use RSA hard and soft tokens. Ref: https://en.wikipedia.org/wiki/RSA_SecurID https://en.wikipedia.org/wiki/RSA_SecurID
  - tinus_hn 3y ago
    Quite possibly with SMS as the fallback option in case the soft token is lost.
    - pnpnp 3y ago
      We have a human in the loop as the fallback. It’s just a different attack vector. Brute force becomes a lot harder, but social engineering becomes easier.
  - rkeene2 3y ago
    The world's largest employer (US Government) uses Smartcards (and no passwords).
dymk 3y ago
https://duo.com/product/multi-factor-authentication-mfa/duo-mobile-app https://duo.com/product/multi-factor-authentication-mfa/duo-...
- cbzoiav 3y ago
  There are a huge number of app based solutions. Enterprises are against them because they can't expect their employees to install 20 different apps for 20 different vendors + the cost of reviewing and onboarding them. So you either need to support SMS or several of the major 2FA app providers including the crappier implementations like Microsoft authenticator.
  - dymk 3y ago
    I work at an "enterprise" company and I'm not expected to install 20 different apps. Duo is just one example, but it supports both push based 2FA and onetime tokens, and those two modalities cover every vendor integration and SSO we have. There's really no excuse to be using SMS nowadays.
- deleted 3y ago
  [deleted]

Impossible if your customers are enterprise.

pnpnp 3y ago

Weird. My fortune 100 company doesn’t use SMS for 2FA.

kristofferg 3y ago
It is still very common for business clients of all sizes, in all industries (even critical infra) to request 2FA via SMS. Good for the company you work for that they dont :)
- yosito 3y ago
  When they request it, they should receive pushback. SMS 2FA is a bad business decision with potentially severe consequences for customers.
  - cbzoiav 3y ago
    "We recommended you went for X and listed SMS security problems as the reasons - here is the email chain" You need to cover your ass, but you don't want to actively push back and risk losing the sale.
throwaway2037 3y ago
I assume that all of Fortune 500 (minus tech majors) use RSA hard and soft tokens. Ref: https://en.wikipedia.org/wiki/RSA_SecurID https://en.wikipedia.org/wiki/RSA_SecurID
- tinus_hn 3y ago
  Quite possibly with SMS as the fallback option in case the soft token is lost.
  - pnpnp 3y ago
    We have a human in the loop as the fallback. It’s just a different attack vector. Brute force becomes a lot harder, but social engineering becomes easier.
- rkeene2 3y ago
  The world's largest employer (US Government) uses Smartcards (and no passwords).

dymk 3y ago

https://duo.com/product/multi-factor-authentication-mfa/duo-mobile-app https://duo.com/product/multi-factor-authentication-mfa/duo-...

cbzoiav 3y ago
There are a huge number of app based solutions. Enterprises are against them because they can't expect their employees to install 20 different apps for 20 different vendors + the cost of reviewing and onboarding them. So you either need to support SMS or several of the major 2FA app providers including the crappier implementations like Microsoft authenticator.
- dymk 3y ago
  I work at an "enterprise" company and I'm not expected to install 20 different apps. Duo is just one example, but it supports both push based 2FA and onetime tokens, and those two modalities cover every vendor integration and SSO we have. There's really no excuse to be using SMS nowadays.
deleted 3y ago
[deleted]