Do you use passwordless authentication or what?

TairikuOkami · Jul 1, 2023

Comport Colin said:
SmartCard+PIN logon for: windows, keepass, ssh (putty wincrypt), no password known to me.

That is another extreme, "too much" security. What is your recovery strategy?

What it's like to get locked out of Google indefinitely

"I'm angry at myself for not having even thought of the possibility I could lose my Google account with everything in it."

www.businessinsider.com

trevo · Jul 1, 2023

echo2446 said:
Here's the article that argues using SMS 2FA is better than nothing at all, but using other more secure methods are abundantly preferred. Why You Shouldn’t Use SMS for Two-Factor Authentication (and What to Use Instead) This article also mentions that the National Institute of Standards and Technology is no longer recommending the use of SMS messages for two-factor authentication.

That article is six years old, do you consider it still applies?

TM21 · Jul 1, 2023

When I log in to any place that requires a password, I use one, but it's 18 characters long and beyond guesswork.
Then I keep the malware off of my PC, so I'm not worried about that.

Stay safe, Mates!
TM

echo2446 · Jul 2, 2023

trevo said:
That article is six years old, do you consider it still applies?

I personally believe that having some form of two-factor authentication (2FA) is better than having no additional protection apart from your password. Without your password, unauthorized individuals cannot log in to your account. However, if someone gains access to your password and you have no 2FA in place, they can immediately gain entry. Because there are issues with SMS-based 2FA, it is advisable to consider alternative methods when available. Here's another recent article, from Kaspersky, also saying that it can work as 2FA: Types of two-factor authentication: pros and cons

Summary: this two-factor authentication option gets the job done, but to protect the most valuable accounts — especially those related to finances — it’s better to use something more reliable.

One reason not to rely on SMS-based 2FA is that it can give you a false sense of security. If you consider an account important and should exercise extra caution, you might be more attentive with a strong password and good security practices without 2FA. Treating SMS 2FA as a sufficient measure might lead to complacency, and this can leave you vulnerable since hackers are highly motivated to exploit weaknesses, unlike the less important accounts.

Personally, if there are no other options available and I have access to 2FA recovery codes, I would enable SMS 2FA. However, this is purely hypothetical for me since the only account I might enable this option for does not offer any recovery codes (or alternative 2FAs I can use). Therefore, I must choose between SMS 2FA alone or no 2FA, and in this case, I choose not to use it.

BRAC · Jul 2, 2023

TraderGary said:
All accounts have 20 character random generated passwords.
The Master Password is 32 characters.

Doesn't inspire much confidence when all your 20 character passwords are just a notepad away to the prying eyes. Depends, of course on the odds of someone/something mucking about your TEMP directory.

In case it's still unclear, the DerTxsNm.part is a failed export of your plain-text Password Vault. A successful export will only differ by the .csv extension. This particular screenshot has only one. At one time I've had five or six such failed vault dumps in the Temp Dir, back when a Vault-export failure was rampant. Don't know if things have changed because I have since switched.

When I brought it to their attention, the lame (indirect) suggestion was to switch browsers (Chrome apparently is their Go-To with Out-of-the-box support). I even made a suggestion (to the support) to give us users the option of exporting the Vault to an encrypted destination of our choosing, but it fell on deaf ears.

Either way, the fact that the export operation writes (in plain-text) to the Temp Dir before moving it to the user-selected location is plain censored. And, it's also around the time when they took away the option of exporting an Encrypted Vault.

Comport Colin · Jul 3, 2023

TairikuOkami said:
That is another extreme, "too much" security. What is your recovery strategy?

I don't see a risk of losing access to my smartcard, since I keep the PUK in a safe place. Even if I lose my SmartCard: the identities can be written to a new Smartcard by the CA admin. So there is absolutely no way to lose access to for example my keepass file unless it gets corrupted (and I have backups) or our whole Active directory goes down for good the same day I lose my SmartCard.

glasskuter · Jul 3, 2023

Any method one chooses to use for extra protection is better than only typing in passwords. Rather than disclose the exact method I use, my opinion on what is the best method of protection would be biometrics using a fingerprint + a password manager. It all depends on one having biometrics available on his device. Is this method 100% secure. No, but then nothing is on the internet these days and people should accept that fact.

Bottom line on how far one should take it, IMO it boils down to 3 things; how one uses his devices to access sensitive information (think willy-nilly logging in from multiple devices which allows hackers multiple means of getting to you) , how much common sense one uses in his computing habits , and how paranoid one is. There is no 'one size fits all'.

ander35 · Jul 24, 2023

My sign in and password combination was leaked several times on the dark web due to hacks. One day I checked my sign in history in microsoft account and noticed like 25 failed sign in attempts from around the world every day. Luckily I had 2 factor. I went ahead and turned on passwordless sign in with microsoft authenticator.

Flashorn · Jul 24, 2023

Marcus Vinicus said:
Curious to know how people here prefer to login and authenticate to keystuff like your bank account and other internet based resources such as online retailers.

State briefly what you use and optionally why it works for you.

I use passwordless via Windows Hello (facial recognition) when available.
MFA or an authenticator app (in my phone) when facial recognition isn't available.
I use LastPass to manage my passwords ( all critical logins have very long gobbledygook passwords).

I don't have allot of sites that I have to log into.
Gmail, here , and the bank.
Use SMS whenever possible and when I have to enter a password, I have Keyscrambler from QFX software
installed.
I also have and always had the camera and bluetooth drivers uninstalled on all notebooks. Also, WiFi is disabled on
my router. Prefer connected.
I use a phone as it was intended to be used, for conversation. Don't need to take pictures. My phone is about
14 years old and is a Nokia slidephone. Don't know if it could be hacked but really, they would not find much.
Don't even keep a record of any phone # on it. Will have to change because 3G is almost out of time. I know
the US is not covering that network anymore but here, we can still access it so, for the time being, this is what I will
be using.

Download – KeyScrambler by QFX Software Corp.

www.qfxsoftware.com

TairikuOkami · Jul 25, 2023

ander35 said:
My sign in and password combination was leaked several times on the dark web due to hacks. One day I checked my sign in history in microsoft account and noticed like 25 failed sign in attempts from around the world every day. Luckily I had 2 factor. I went ahead and turned on passwordless sign in with microsoft authenticator.

Technically, passwordless sign in with MS authenticator is just 1 factor, you will get only 1 prompt on a verified device.
If someone manages to steal your session, you are done for it. You might consider changing your primary sign-in.

Code:

https://account.live.com/SignInPreferences

ander35 · Jul 29, 2023

Thanks, I will make sure I have 2 factor on.

Do you use passwordless authentication or what?

Microsoft 365 Basic

My Computer

Well-known member

My Computer

Banned

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

aka Mama Glass

My Computers

Member

My Computer

Well-known member

Attachments

My Computers

Microsoft 365 Basic

My Computer

Member

My Computer

Similar threads