Two-factor Authentication *sigh*

[Ghel]

Our IT department (one part-time guy) finally rolled out the two-factor authentication they've been warning us about for months. At first, they'd emailed everybody that we were going to have to install an app on our personal cell phones (since the company doesn't provide us with phones) to get the code for authentication. I adamantly refused to install an app for work on my personal cell phone. I told the IT guy as much. He'd offered an alternative in the email - that the company would provide a device to give the code instead of using an app. I said I'd rather have that.

I guess they got enough responses from people not wanting to install an app on their personal cell phones that they decided to get a physical token for everyone, at least at our branch. Now when we log in to Windows, an additional window pops up asking us to enter the code. We push the button on the device, a code appears on the LCD screen, and we type it in. There's also a checkbox to not bug us for a code for 10 hours. Which, to me, defeats the purpose of 2FA.

Now, granted, we're pretty lax about security because we're a small branch and there's almost no way a bad actor could access one of our computers without an employee noticing. But say I lock my pc when I went to lunch. Someone walks into my office and sits down at my PC. Somehow, the other employees don't notice. The person somehow gets my Windows password. The 2FA screen pops up. Do they go "aw, shucks" and walk away (like a recent training absurdly seemed to suggest)? Or do they look around for a device with the same logo as the 2FA screen? Oh, there it is in my desk drawer! Push the button, and voila! <the biggest of facepalms>

Honestly, I don't see how this is more secure than our already super-complicated passwords. So complicated most employees write it down on a post-it note or in a notebook stored conveniently close to their PC. It just annoys everyone.

[Kristev]

Most solutions ultimately just make the problem worse.

[earl colby pottinger]

Why would they need an app on your phone? My bank has a 2FA, if I logon a password is needed, then it texts a random code to my phone which I have to enter to get at my accounts.

If someone had access to my computer, that does not give them access to my phone with the code that is WITH ME, not on the computer.

And no APP needed to be installed to do this.

[Ghel]

I'm not sure, earl. I suspect it comes down to one of two things: either whoever decided on this product felt that it was more secure, or it was cheaper than getting set up to send texts to employees.

[RealUnimportant]

The idea of those token devices is you keep them with you, not leave it in the desk drawer. Most of them are designed to be suitable for attaching to keyrings to aid in this portability.

[Ghel]

Yeah, that's what I thought, too. It even has a keyring on it. But the instructions relayed to us was to just keep it in our desk. I'm not sure if that's BM's misunderstanding or if that came from the IT guy. Probably the former.

I don't really want it on my keyring. That means I take it home with my work keys at the end of the day. And I never work from home, so there's no need for me to have the token at home. More than anything, I don't want to lose the thing.

ETA: The official advice from management is now NOT to put our tokens on our keyring. Don't take them home with you for fear of getting lost or forgotten. Keep them at your workstation but out of sight "if possible". All per an email that went out to everyone this afternoon.

As mentioned before, this doesn't add any security. Just extra steps for the theater of it.

[Arcus]

I will never install something like this on my personal phone again. My last job found an email security app that added in a tracker so management could see where we were at all times. I noticed my battery draining faster than normal and looked into what was running and found what they had done. I changed the settings to only allow tracking when the app was open and a day later I got called into the managers office because "the systems is reporting a problem with the app". They denied any knowledge of it tracking our location yet let it slip that the system reported that the app only seemed to work when I was in the office (when I had to open the app to get into my email.)

[earl colby pottinger]

Arcus: You then ask, "Why do you care if the APP is not working when I am not in the office?".

[Kittykat]

There is NO way I'd allow work to install an app on my personal cell phone. Provide me with a work phone or GTFOH.

[Ghel]

It's bad enough that a lot of the websites that we use at work, for credit reports, various federal loan-related sites, etc., want to send me a text with an authorization code for 2FA. If they give me the option, I have the site email me instead. But some sites don't have that option, so I have to let them text my personal cell phone. It doesn't cost me anything, but it's annoying.

[csquared]

so I have to let them text my personal cell phone.

Google voice. If your employer doesn't block the web site, you can even read the texts on your computer. Copy/paste the code.

My employer pays $50/month if you bring your own device. They require outlook mobile and a couple of authorization (MFA) apps. I opted for Zoom Phone (not required) and I gave them a Google voice number.

I am also required to let them wipe my phone (remotely) when I leave. Can you say "Cloud backup" boys and girls?

[Seanette]

I'm not sure, earl. I suspect it comes down to one of two things: either whoever decided on this product felt that it was more secure, or it was cheaper than getting set up to send texts to employees.

Or, being really cynical/paranoid, the app might offer possibilities for corporate snooping employee devices.

IF I ever find myself in a situation where my job insists that I have certain things on my phone, I'll go get the cheapest phone I can find and tell them "this is the one I will be using for anything work-related. Deal with it".

[Ghel]

I found out today that the 2FA doesn’t work if we don’t have internet.

We had a power outage over the weekend and returned Monday to find our internet connection not working. When I logged into my pc, the window for 2FA didn’t come up. It just let me into my desktop. Without internet, I can’t do much, but I can access my emails and documents that are saved locally.

This would seem like a huge security issue, if this wasn’t already just theater.

[Ironclad Alibi]

What? A power outage negates the fancy security system. Who would have thought of that? Except for the screen writers for the first Die Hard movie in 1988.

[RealUnimportant]

These doohickeys do often need the interwebs, but to default to "just ignore it" when there is no web is definitely a faux-pas (that's french for "fuck up") on behalf of the installers!