Re:Multi-factor authentication isn't necessarily strong
by mindslight on Friday December 27, 2019 @02:36PM
(#21893797)
Real security is hard work, because it requires imposing a burden on users, as well as diligent design to not then squander it.
Snake oil is profitable, because you can sell it in place of security while not making the users and developers do that work.
"Multi factor authentication" has trickled down into snake oil drip pan. That is what a "soft token" is. That is what text message / email verification is. That is what additional passwords are (eg "what is your favorite high school"). These "solutions" let companies check an "MFA" box with no substantive changes.
Not that I want any of these companies pushing "MFA" onto users to insist on more invasive methods either. I like that their bullshit SMS challenge goes to a cloud provider and pops up in a terminal ready to be pasted, because frankly that challenge wasn't wanted by anybody except whomever in their company needed to check that box!
Snake oil is profitable, because you can sell it in place of security while not making the users and developers do that work.
"Multi factor authentication" has trickled down into snake oil drip pan. That is what a "soft token" is. That is what text message / email verification is. That is what additional passwords are (eg "what is your favorite high school"). These "solutions" let companies check an "MFA" box with no substantive changes.
Not that I want any of these companies pushing "MFA" onto users to insist on more invasive methods either. I like that their bullshit SMS challenge goes to a cloud provider and pops up in a terminal ready to be pasted, because frankly that challenge wasn't wanted by anybody except whomever in their company needed to check that box!
It's Sturgeon's / Gresham's law all the way down.