Microsoft wants you to ditch SMS-based multi-factor authentication mechanisms

guest · Nov 11, 2020

Microsoft wants you to ditch SMS-based multi-factor authentication mechanisms
November 11, 2020
https://www.neowin.net/news/microso...-based-multi-factor-authentication-mechanisms

With a large portion of people working from home in light of the ongoing pandemic, digital security and privacy has become more important than ever. And while we may not be observing the National Cyber Security Awareness Month (NCSAM) anymore, Microsoft has not given up on promoting cybersecurity initiatives.

Now, Alex Weinert, who is the Director of Identity Security at Microsoft, has penned a blog post highlighting the need to move away from multi-factor authentication (MFA) mechanisms which are based on publicly switched telephone networks (PSTN).
Click to expand...

The executive has highlighted various reasons to let go of MFA systems based on PSTN such as SMS and voice. However, Weinert has emphasized that MFA itself is essential, it's just the way people use it that should change.
Click to expand...

Microsoft: It's Time to Hang Up on Phone Transports for Authentication

In my blog Your Pa$$word doesn't matter, I laid out the key password vulnerabilities, and in response to a gazillion “but other creds can be compromised, too” DMs and emails, I wrote All our creds are belong to us, where I outlined vulnerabilities in credentials other than passwords and highlighted the promise of passwordless, cryptographically protected creds like FIDO, Windows Hello, and the Authenticator App.

Today, I want to do what I can to convince you that it’s time to start your move away from the SMS and voice Multi-Factor Authentication (MFA) mechanisms. These mechanisms are based on publicly switched telephone networks (PSTN), and I believe they’re the least secure of the MFA methods available today.
Click to expand...

Palancar · Nov 11, 2020

However; the larger issue for me is that MANY websites ONLY offer SMS as their version of 2FA. Check through the numerous websites you have accounts with and try to establish TOTP or true U2F. It won't happen for most. Sad.

Rasheed187 · Nov 15, 2020

Palancar said: ↑

However; the larger issue for me is that MANY websites ONLY offer SMS as their version of 2FA. Check through the numerous websites you have accounts with and try to establish TOTP or true U2F. It won't happen for most. Sad.
Click to expand...

Yes, it's annoying. But I would also like to move away from the smartphone completely! So authentication apps wouldn't be a solution for me. I would rather make it so that you can register "trusted devices" in which 2FA is being performed by the CPU itself on the laptop, tablet, desktop or even smartphone. And if you have to use services like email or online banking on somebody's else device, you can always fall back on 2FA via smartphone or hardware token, good idea or not? See link for more info.

https://blog.dashlane.com/intel-u2f-dashlane-2fa/

Log in or Sign up

Microsoft wants you to ditch SMS-based multi-factor authentication mechanisms

guest Guest

Palancar Registered Member

Rasheed187 Registered Member

Log in or Sign up

Microsoft wants you to ditch SMS-based multi-factor authentication mechanisms

guest Guest

Palancar Registered Member

Rasheed187 Registered Member

Useful Searches