Microsoft - Users going passwordless

[techie17]

Hi

 

Saw this news article on the BBC today. How practice is this in a school environment? Our staff are not allowed personal phones in school for safe guarding reasons:

 

https://www.bbc.co.uk/news/technology-58575954

[Michael]

I think there lies the problem, for home users or small businesses, this will work. It wouldn't necessarily work in enterprise or education environments.

[mavhc]

If you have money you buy a standalone device.

 

Does this mean it's 1 factor authentication again?

 

It's strange that teachers are allowed to be in rooms with children and talk to them but can't be trusted to have a phone because they might use it for evil.

 

Of course we all know it's because the boss doesn't trust the employees to not waste time on their phones.

[nadeem]

There are other methods aside from a phone that can be used

[atcoates]

You can use physical security keys, or Windows Hello (if possible) so doesn't have to be a phone.

[Michael]

Showing my age now, but makes me think whether Pagers could make a return. It's all one way and perfect for receiving a passcode or pin and literally nothing else!

[DalekSec]

We've had it enabled for IT for few months. Only turned it on myself today when I saw the news story and reminded me!

 

As for staff, ours are allowed phones with them. But we are private so unsure if state schools do allow or not!

[Chaniel]

I think there lies the problem, for home users or small businesses, this will work. It wouldn't necessarily work in enterprise or education environments.

 

This is already a reality in a lot of environments though. You can have multiple authentication methods (App on a work phone, physical key such as a Yubikey), simple to set up and simple to use.

 

I've been using a Yubikey + PIN for a little while now to test, no issues really.

Edited September 16, 2021 by Chaniel

[dhicks]

Showing my age now, but makes me think whether Pagers could make a return.

 

You can get very similar one-time code generating dongles, we considered them for our 2FA rollout. We went for USB dongles in the end, and I did wonder if we could set them as the only method of login (touch your dongle on a reader attached to the PC, logs you in), but we figured we'd stick with a username and password as well for now. Users can use the dongles to log straight in to the printers, though, and we could make the same dongles work for the door system as well.

[DavR]

It's called muti factor authentication for a reason, you're using more than one piece of information to authenticate. Removing passwords and just relying on authenticator apps or keys just makes it single factor again. Someone steals your key / phone, they have access to your systems.

 

Finger print or facial recognition is a step forward for sure, but I can't see the more security conscious dropping the extra layer of username/password security just yet.

[HPlum78]

These kinds of things always interest me as it shines a light on risk and how different people perseve risk.

 

So the issue with a password is that with the right amount of GPUs and rainbow tables passwords can be cracked if they are "weak". Even if they are not weak brute force attacks against an institution can be a pain for its users and IT Department to say the least. So MFA is put in the mix to make sure that if an individual/ group of nefarious actors do brute force/ fish a password there is a good chance of them needing the other factor (I say good chance as this is not a guarantee). This is the broad brush stokes around passwords and MFA.

 

So there has been a push towards passwordless, MS have not removed MFA here they have just removed the requirement for a password as a factor to be clear. So it interests me that we turn to the position around if the phone (insert token here) is stolen, this is a big leap in my mind as this now means that those upto yet anonymous nefarious actors are going to step up and turn in to groups willing to go out and steal those from your users! Don't get me wrong there will be cases when a phone (token) gets stolen/ lost and by some coincidence the requirement for another factor is not required but that seems far less likely than what is happening right now with passwords.

 

I will also add that I do not for one second think that thugs are going to start robbing people in the street for their phones/ fingers and eyeballs they will clearly turn their attention to the technology and we will have to see what becomes of those efforts.

Edited September 16, 2021 by elsiegee40

[jthompson]

Hmm. You can take my password away... when you pry it from my cold dead hand!

[HPlum78]

What you mean like they are doing right now! for a group of IT professionals we sure like clining on to past... it needs to be seen how good the technology that underpins all this turns out and let's face facts MS is testing this right now with an extended set of beta testers beyond their own staff. It a brave new world out there!

[mavhc]

Passwords are only for dumb terminals, we have smart phones that can do cryptographic signatures.

 

Also remember the difference between and online account where 7 billion people can try to access it, and a local account where 7 people can try.

 

Then note that if you can remember a password it's too simple, and if it's not too simple you're using the same password everywhere.

 

What's annoying is fingerprint login is per device, not in AD

[Protec]

Sounds similar to DUO security MFA which sends the users own phone an approval before allowing you to log into Windows 10 on the work computer.

[jthompson]

Hopefully passwordlessness can be reasonably well standardised, much like OTP or U2F, so that there's not too much fragmentation across providers. I don't fancy being invited to run a different auth app for every service going in order to adopt it.

 

Although I'm not sure that YubiKey-wielding tinfoil-hat brigade are really who MS are targeting here. It's the password-only masses that this is aimed at.

[Roberto]

I blogged about implementing Azure AD/O365 passwordless here if that’s of any use.

 

I don’t think it’s going to be easy to ‘standardise’ this as such, much like MFA push, it’s vendor specific unlike TOTP. However, the two identity providers I’ve got in-depth experience with personally, MS/Azure AD and Okta, both can already be a standard login provider for thousands of applications from hundreds of vendors, including some you’d possibly be surprised at due to rivalries.

[mavhc]

Just need some people to get together to make a standard for push logins, MS and Google won't until forced, so it's up to the other players to band together to outplay the giants.