Sysadmins dislike phone-based MFA

“We have sometimes the issue that we create a vendor login and account with (for example for Apple Business Manager) and we have to add a phone number that is used for two factor authentication with OTP's send for login. It is not possible for us to create accounts for every engineer (+150 engineers), escpecially for those vendor / site logins. We use a lot of shared accounts for this purpose. To get the comments out of the way, for admin tasks we have named accounts, GDAP and other solutions”

“You may wish to consider whether you're able to just go with: TAP plus device bound and attested passkeys from a managed list of AAGUIDs for all users (WHfB, Authenticator Passkeys, authorized hardware FIDO2) further restrict to hardware FIDO2 tokens only for all administrators (even if using PAWs) These are enforced via Conditional Access / Authentication Strengths / Passkey profiles; in the above scenario you'd need two of each. Synced passkeys are great to quickly get to phish resista”

“I was mind blown that I had to open the app and scan a QR code. We ditched Microsoft MFA and went full DUO. Much more seamless and straight forward.”

“You can either make a passkey on each device Or if you make it on your device (at least in MS Auth app), and assuming both your PC and Phone have BT, you can scan a barcode on your PC using your phone to sign in with your phone's passkey. I'm in no way arguing in favor of any of that, just wanted to mention that one possibility. PW managers complicate things a lot though, counter-intuitively.”

“I can't really use MFA on my bank accounts. They only support phone numbers. I really would prefer to have phone authenticator stored in the TPM + my Yubikey for things I care about. But railroading consumers into MFA when they only have a single device is bad, and 2-step auth like SMS is not MFA. Fundamentally it's about multi-enrollment, and IMO pushing MFA onto people without making sure that they understand they need more than one device enrolled is irresponsible. Availability is jus”

“I think the point with a passkey is that those very loose backup methods are required, since just knowing the password is not a thing. Everyone gets a new phone and is at risk of the previous one being unavailable. So passkeys mean that there's no way to deal with that reality, and also be truly secure.”

“In a corp environment, it is the business's problem when a user's passkey devices fails. In a personal environment, it is the user's problem. Specialized knowledge and preventive processes in the corp environment aren't present in the personal context, and saying "pretty please" to Google or Apple when something goes wrong is usually a waste of time. I 100% agree with TFA -- "damage expectation" is probably higher with passkeys.”

“I hate that there's no accepted definition whether passkeys should be considered MFA or not. As a result, some sites treat it as MFA and you just provide passkey and you're in, which I like. Other sites still ask for a second factor after I provide a passkey which I think is stupid. At that point, it's simply another password I can't remember. I should not be prompted for a second factor after I log in with a passkey.”

“As someone who uses a single password manager on my computer and phone, I don't see the problem with passkeys. I use Safari on both and I never even had to "set up" anything.I can see why they would be problematic for people who otherwise live life with a single love2025 password though.”

“I am trying to setup Duo Security on my PC at the office so that in the event I lose my phone or my phone is smashed what do I need to enable in the installation process to allow me to bypass the MFA/Passkey push? Thanks, submitted by /u/3G_Lighting [link] [comments]”

“Yeah agreed. That’s why I said MFA resets with a new phone is a different story, not something that can be done with SSPR. In an ideal world users have a second form of MFA outside of their mobile to get into their account to setup their new phone themselves.”

“Design flaw: an account can reach a state where the only MFA method has no credential on any device — support says no recovery is possible”

“Why would they not be able to have cell phones? Do you mean not able to use work apps on cell phones? An Authenticator app shouldn’t count for that.”

“Thoughts for offshore users on VMs/remote desktop not allowed to have/use cell phones?”

“I’d just buy them yubikeys and save yourself the trouble. You’ll spend a lot more in lost time than it would cost to just buy them.”

“We have 1 objector and 1 person with a chinese phone (no app store). This is a decent use case for them. But yeah, it would be a pain to do at scale.”

“Most of the users where I work don’t complain about having an Authenticator app, so no. The rest have yubikeys. Only really needed TAP for when someone doesn’t have any MFA method set up in order to get one set up. After that, they use one or the other for MFA. I would absolutely have those in place before trying to roll out WHfB.”

“That’s fair. They aren’t going to get a good solution for that without requiring phones or an additional investment.”

“Only if they have a dedicated machine. If they're FLWs, they may primarily use shared devices where WHfB becomes impractical.”

“You don’t even need an app for passkeys - just setup a synced one right to the phone”

“Ok don’t get the app and just setup a passkey on the device itself. Similar concept to facial recognition. But you’d make a fit over that too I suppose”