News for hackers. Stuff that matters.

A comment on I read the federal government’s Zero-Trust Memo so you don’t have to. Parent comment

Re:I read the federal government’s Zero-Trust Memo so you do... by freedomben on Thursday January 27, 2022 @07:42PM (#30109250)
The frustrating thing to me is that as a user they don't give us any tools to help ourselves. I would gladly make it a "team" account and login individually if we could. I would gladly do a shared TOTP, or whitelist login locations, or anything like that. Or at least give us the option to accept the risk and disable whatever anomaly detection they are applying. But no, that's not how the software world works anymore. Extreme paternalism mode is the only option as a user.
[ Parent | on HN ]
Re:I read the federal government’s Zero-Trust Memo so you do... by blackrobot on Friday January 28, 2022 @12:11AM (#30110907)
Why don't you share a TOTP between all of you? Just take a screenshot of the authenticator QR code, or save it to a shared 1password secret.

Google's login protection mechanisms seem to be satisfied by TOTP usage, and you won't be locked out anymore (or at least much less likely to be).

[ Parent | on HN ]
Re:I read the federal government’s Zero-Trust Memo so you do... by freedomben on Friday January 28, 2022 @07:04PM (#30122262)
You're right that would totally work with Google. In our case the boss is quite computer illiterate and trying to get him to use LastPass was hard enough. He will tolerate a lot of pain from getting locked out before he'll be willing to learn TOTP :-(

And for many of the SaaS that we use, TOTP doesn't help you avoid the security lock outs.

[ Parent | on HN ]
Re:I read the federal government’s Zero-Trust Memo so you do... by throwaway48375 on Thursday January 27, 2022 @10:40PM (#30110477)
Why do you need to all access the same account though? Can't you grant access to whatever resource you need to multiple accounts?
[ Parent | on HN ]
Re:I read the federal government’s Zero-Trust Memo so you do... by freedomben on Friday January 28, 2022 @12:35PM (#30117791)
For some of them we can, for others no. Sadly it seems as though supporting this sort of thing is not a priority for most SaaS
[ Parent | on HN ]