The New Ten-Factor Authentication Processes

Re:The New Ten-Factor Authentication Processes by t-writescode on Tuesday November 23, 2021 @09:05PM (#29326214)

5-factor auth is an obnoxious thing and real.

  1. username and password for website
  2. token sent to email
  3. login for email (auto logged out)
  4. email 2fa that requires SMS 2FA or Google auth, stored on phone
  5. pincode / face for phone

edit:

Oh! I could add 2 real more:

  -1: password manager login
   0: password manager 2fa

[ Parent | on HN ]

Re:The New Ten-Factor Authentication Processes by retzkek on Tuesday November 23, 2021 @09:16PM (#29326284)

RSA soft tokens require a PIN. Some versions it's appended to the code, some you enter it to get the code (both exist in my organization). So that's like three more factors right there.

[ Parent | on HN ]