#authenticator

[techniktagebuch]

5. März 2024

Schlüssel, Schlösser, Türen, Fort Knox

Ich benutze seit vielen Jahren für alle halbwegs relevanten Zugangsdaten eine Mehrfaktor-Authentifizierung. Eine Zeitlang war der geforderte "zweite Faktor" bei vielen Logins ein Code, der mir per SMS an mein Handy zugesandt wurde. In den letzten Jahren wurde dieser nahezu überall von einer Smartphone-App, einem Authenticator, abgelöst.

Nur mein Arbeitgeber konnte bisher keine solche Mehrfaktor-Authentifizierung implementieren; es scheint schwierig zu sein.

Ich habe mich darüber in den letzten Jahren oft beschwert und habe dringend darum gebeten, dass auch wir gängige IT-Standards befolgen sollten. Nun wurde unsere IT tätig und hat – endlich – auch bei uns MFA eingeführt.

Das Einloggen funktioniert seit heute also folgendermaßen:

Schritt 1: Ich logge mich an meinen Laptop mit Benutzernamen und Passwort (erster Faktor) ein. Schritt 2: Dann starte ich das VPN-Programm am Laptop. Dort logge ich mich mit einem anderen Benutzernamen und Passwort (zweiter Faktor?) ein. Schritt 3: Nun öffnet sich ein Browser mit einem weiteren Authentifizierungs-Fenster. Dort gebe ich einen weiteren Benutzernamen und das zugehörige Passwort (dritter Faktor?) ein. Im Browserfenster wird jetzt eine zweistellige Zahl angezeigt, gleichzeitig meldet sich die Authenticator-App an meinem Smartphone. Schritt 4: Ich entsperre mein Smartphone (zweiter Faktor!) mit meinem Fingerabdruck (noch ein Faktor) und öffne die Authenticator-App. Schritt 5: Dort muss ich die auf meinem Laptop im Browserfenster angezeigte zweistellige Zahl eingeben. Schritt 6: Nun muss ich die Freigabe des Logins noch einmal mit meinem Fingerabdruck auf dem Smartphone in der Authenticator-App bestätigen (weiterer Faktor?) - und schon bin ich am Laptop eingeloggt.

Jaja, IT-Sicherheit kann in Fort Knox schon als unbequem empfunden werden.

(Molinarius)

[ohihopeicanchangethislater]

I've discovered the paradox of the ages.

I got signed out of my school Microsoft account. I guessed my password, but to get in you need to enter a code from a notification on the Authenticator app.

But since I'm signed out of my account, I'm not receiving notifications from Authenticator. I try to sign in, but after I enter my password, it asks for me to enter a code from the Authenticator. But since I'm signed out of my account, I'm not receiving notifications from Authenticator.

I could go on...

[continuations]

Browser, Wallet or Something New? Looking for Crypto Ease of Use

The internet was around for about two decades before the arrival of the web supercharged its growth. The ease of using a web browser made broad consumer adoption possible. Mobile payments were around for at least a decade before they started to take off. Again the key factor to adoption was ease of use -- this time in the form of wallets that are actually integrated with in-app payments and widely accepted at the point of sale such as Google and Apple Pay (in other parts of the world adoption was driven by carrier billing or pre-payment -- again questions of convenience).

Similarly crypto is approaching a decade of existence. And we are still looking for the massive increase in the ease of use that will enable broad adoption. It is possible that clinging to the browser and wallet metaphors may be holding us back. The browser is strongly associated with content. The wallet is strongly associated with payments. But crypto is so much more than both: it is a new infrastructure for decentralized systems.

Lots of smart people are working on browsers and wallets that are crypto enabled. And I am glad that’s happening, as the right answer may come from that work. But it would also be good to see experimentation with a new metaphor. Candidates that come to mind are: agent, proxy, and authenticator. A piece of software that I, the enduser, control and that represents me vis-a-vis the decentralized infrastructure.

What would be included in such a “representation” app? Authenticating myself and granting/revoking access to my data. Storing and managing my private keys (possibly in a highly abstracted manner, where I don’t even need to know what a key looks like). What does representation *not* have to include? The UI/UX of decentralized applications can be separate and handled by each app, including payment and investing applications. Some of the apps can be web based and others native (or the same app can have a web and a native experience). The closest thing we have to this representation concept today are password managers.

If you are aware of any projects that are explicitly pursuing this direction, I would love to hear about them.

[magus-of-the-color-pizza]

So today as I attempted to log into battle.net for my daily 10 minutes of gaming I was asked for an authenticator code, despite never having one and not even knowing what it was, 10 minutes ago. I hope I wasn’t hacked or anything like that, I’ve created a ticket and hope Blizzard responds soon T-T)

[fixmypc24ex]

What are passkeys really? The simple explanation - for anyone tired of passwords | ZDNET

What are passkeys really? The simple explanation - for anyone tired of passwords

Yes, the technology underlying passkeys is confusing. Here's a plain-English guide that can help you ditch passwords today.

[cyberdudebivash-news]

Microsoft to Wipe Authenticator on "Insecure" Phones. Here's How to Protect Your Account.

Read the full report on -

Microsoft to Wipe Authenticator on "Insecure" Phones. Here's How to Protect Your Account.

CyberDudeBivash offers real-time cybersecurity news, threat intelligence, zero-day vulnerabilities, malware reports, and security tools.

[newstech24]

Microsoft Authenticator is ending assist for passwords

Microsoft will quickly now not allow you to use its Authenticator app to retailer or autofill passwords. Beginning in July, you received’t be capable to autofill saved passwords utilizing Authenticator, and also you’ll have to make use of Microsoft Edge or one other password administration resolution as an alternative. Microsoft additionally plans on deleting your saved cost info in…

Microsoft Authenticator is ending assist for passwords