Learn me on 2FA

[GoinAllTheWay]

Originally Posted by photon

If I get a hardware key I think I'd want to get a 2nd key as a backup, so will be the same question.

I don't have a bolted down safe in my house, but that's an option. Are safety deposit boxes still a thing?

Getting a 2nd hardware key is strongly recommended on the yubikey website and for the price of them, a no brainer.

Safety deposit boxes very much still a thing. That's a great idea. I think you'd want to treat keys the same as backups. One local and one offsite. Although I have no idea what the cost is for a SDB, the small ones can't be much.

**edit**

just looked up pricing (RBC), they range anywhere from $60 to $500 annually.

[Hack&Lube]

If you have an iPhone you can backup your authenticator to icloud. This helps if you are switching phones. The most common cases of losing authenticator access is when you buy a new phone.

[Hack&Lube]

Originally Posted by GoinAllTheWay

Well that's interesting.....we currently RDP into work through a VPN but no MFA. I should bring this up ASAP. I assume that's the MS Authenticator you use for that? Is that an app or hardware based?

Yes, someone who has compromised an internal employee password can then jump straight into the internal corporate network unless VPN is protected by MFA or zoned off.

There are lists of employee passwords on the dark web and employee passwords can be easily compromised by simple email phishing attempts or by weak passwords. I don't know what your work password policy is but over a decade I have seen everybody us Spring2021, Summer2021, etc. style passwords for everything due to the quarterly password expiry.

[GoinAllTheWay]

Originally Posted by Hack&Lube

I don't know what your work password policy is but over a decade I have seen everybody us Spring2021, Summer2021, etc. style passwords for everything due to the quarterly password expiry.

Ya, those drive me nuts. My personal PW peeve is when people then write it down on a post-it note and stick it on their monitor

I did a ton of reading last night on authenticator apps. Isn't the idea behind backing up the codes for various sites you are using the authenticator on a bad idea? I get the importance of the backup codes but how is backing them on to the cloud protected? Seems like a pretty big hole to me.