I find tokens to be incredibly hard to manage and if you lose them you’re completely screwed forever. And then there’s the problem where every employee gives you a security key do you don’t know which one has which credentials (yes you can add keys but managing all of that physical stuff has a cost).
Although they’re not popular in security circled because technically they’re still vulnerable to phishing websites, I prefer TOTP apps like Google authenticator because it’s backed up to the cloud so even if I lose my phone I know I can get back the keys; it’s the best trade off for security vs usability.
I was confused on my first read through: this guidance seems to refer to federal enterprise applications, not necessarily customer-facing services.
It seems reasonable to me to require employees to use a physical authenticator. Heck, how many of the people here use them and require employees to use them? Often to secure access to applications and resources less consequential than Official Acts Of The Federal Government.
It would feel less reasonable (and a throwback to the ‘00s) to mail out hardware authenticators to customers/members of the public just to, say, buy stamps from the USPS or something.
But the employee needs to be responsible enough not to lose it, they definitely need to not be able to back it up to god-knows-what consumer-grade provider (or to duplicate it at all). And when they lose it, IT needs to know to invalidate the lost one and issue them a new one.
My impression is that physical authenticators (often in the form of smart cards that double as employee ID) are pretty much table stakes in serious federal environments anyway, is that mistaken?
> My impression is that physical authenticators (often in the form of smart cards that double as employee ID) are pretty much table stakes in serious federal environments anyway, is that mistaken?
I'm a Federal contractor. At least for my agency this is table stakes for any application period. I don't even have a password anymore. For the very small number of legacy applications that don't support smart card auth I have to log in to a different service to get a temporary password that expires after 24 hours.
Yes but as I said, I’m personally less concerned about a successful phishing attack. I can see why you might be concerned as an employee to a multi billion dollar business but attacks on my personal safe are unlikely to be sophisticated enough to fool me / I’m not a target for sophisticated ones. UX vs threat model tradeoff.
You should be very concerned about phishing. The push towards modern phishing-resistant authentication was spurred from large scale studies of phishing success against very smart targets (security teams at Google, for instance). It's probably drastically less expensive to put a "sophisticated" phishing attack together than it is to target you with a memory corruption exploit.
Although they’re not popular in security circled because technically they’re still vulnerable to phishing websites, I prefer TOTP apps like Google authenticator because it’s backed up to the cloud so even if I lose my phone I know I can get back the keys; it’s the best trade off for security vs usability.