2FA in schools

[enjay]

not sure where were gonna find the money for replacements in 5 years time

 

In my experience, 5 years might be a bit optimistic. At my previous school, some staff were starting to feel the hurt after about 3 years, and my own tablets haven't lasted that long either. Factory resetting did seem to re-energise them though (the iPads, not the staff!).

[enjay]

Oh the hell I've had when suggesting you shouldn't be giving work provided devices to students, or your own family to use!

 

In one instance, we created a local user account on the staff laptop for their child. It's embarrassing all round for a staff member to have to say "we're struggling to afford a family computer on the salary the school pays".

Edited December 14, 2023 by enjay

[Rob_D]

We ended up providing school ipads to staff with Authenticator on [...]

They have a device they can use at home to do work

 

It's always struck me as less useful if the authenticator app is on the device you're logging in on (even though I do it myself).

[ITGURU]

Our biggest issue is when students lose or change their phone number, have to keep resetting/changing their 2FA. Seems to be getting more common!

[enjay]

Our biggest issue is when students lose or change their phone number, have to keep resetting/changing their 2FA. Seems to be getting more common!

 

That's because staying with the same provider costs CPI + 3.9% every year.

[Rob_D]

That's because staying with the same provider costs CPI + 3.9% every year.

And migrating their number when they move contacts is just for old folks?

[msi_school]

I got one last week for testing and its great, just doesn't work for GCPW no USB based solution will.

[Primus]

I got one last week for testing and its great, just doesn't work for GCPW no USB based solution will.

 

You'd think they'd fix that wouldn't you?

[gaz350b]

What teacher doesn't have access to sensitive data? Every teacher is required to know who their PP students are, as well as any adjustments needed for disability, medical or religious reasons.

 

I bet most of that data isn’t protected by 2fa in the majority of schools who host their data internally on sims. Some might have it on their cloud MIS but I bet the majority don’t.

 

Internally we wanted as much protected as possible against insider threats while balancing ease of use for those staff that move around a lot in school. It was more about access to email and content in conversations were likely to be a higher concern and of more value to insider attacks.

 

As with all the schools that have school as a safe location they have taken a balanced approach and implemented as far as they can go and have struck a balance with their senior leadership to get the mfa project implemented. Once implemented it’s easier to get it tweaked going forward.

 

Sometimes all we can do is outline the risks, provide solutions and implement what is agreed.

[jthompson]

Given the prevalence of T-OTP these days, I'd be reluctant to not make that an option for staff on their main accounts. If you're staff don't already encounter T-OTP in some way, I'd be very surprised.

 

For a relatively simple concept (stored secret + current time = 6-digit code) it devilishly tricky to communicate clearly to end users. That's not helped when certain companies (*cough* Pearson *cough* Microsoft *cough*) decide to go a bit rogue and roll their own flavour of it in a self-branded app that doesn't quite behave like vanilla T-OTP. Yes, the MS app can do vanilla T-OTP, but it'll try some passkey stuff in the first instance with MS accounts, which although 'fine' will generally just muddy the water for less confident users.

 

It's not really practical for us to mandate 2FA for our students sadly, because we're using Google Workspace and we have a mobile phone ban in classrooms. When the time comes, though, it's going to test my instruction-writing skills to the max.

[howartp]

I have been looking into options for our schools recently too. Most teachers have iPads, but they always ... complain about the prompt taking to long to come through.

Use a TOTP app (Google/MS) so all they need is the current code from their app, no waiting around for the push notification to arrive.

[PotNoodleTech]

How do you force TOTP my staff are being asked for codes using authenitcator?

 

Thanks

[howartp]

How do you force TOTP my staff are being asked for codes using authenitcator?

 

Thanks

Erm, TOTP is codes from authenticator?

[PotNoodleTech]

Ah sorry I thought you meant the 6 digit code always displayed in the app. My bad.

[howartp]

Ah sorry I thought you meant the 6 digit code always displayed in the app. My bad.

 

Now i'm confused.

 

I do mean the 6-digit code which changes every 30 seconds - this is TOTP (Time-based One-Time Password), displayed in either Google Authenticator, MS Authenticator, or any other device/token that gives 6-digit codes.

 

My original comment was to a user that has theirs set to send a push notification (to tablet/phone) saying "Is this you?" and you either click "Yes" or enter the relevant 2-digit lottery ball number from the push notification into the prompt, depending how it's been setup.

[jthompson]

This perfectly illustraties my earlier point about non-vanilla TOTP 'authenticator' app functions muddying the waters.

[PotNoodleTech]

Now i'm confused.

My original comment was to a user that has theirs set to send a push notification (to tablet/phone) saying "Is this you?" and you either click "Yes" or enter the relevant 2-digit lottery ball number from the push notification into the prompt, depending how it's been setup.

 

Yes that's what I meant - how do you go back from the 2 digit is this you thing to just using the 6 digit code out of interest?

Mine used to be 6 digit code when I first set it up but it seems it changed itself to is this you prompt at some stage?

[ITGuyNW]

I read a few months ago that Microsoft were favouring the notification method rather than the 6 digit one.

 

Microsoft Authenticator mandates number matching to counter MFA fatigue attacks | ITPro

[howartp]

Yes that's what I meant - how do you go back from the 2 digit is this you thing to just using the 6 digit code out of interest?

Mine used to be 6 digit code when I first set it up but it seems it changed itself to is this you prompt at some stage?

 

Go to Azure > MS Entra ID > Users > All Users > Per-User MFA > Service Settings - we have "Notification through mobile app" unticked; note that this is the old MFA config page which is going away in Sept 2025.

 

The new page is Azure > MS Entra ID > Security > Authentication Methods > Policies - we only have Temporary Access Pass enabled here at the moment; MS Authenticator is disabled.

[Oaktech]

I read a few months ago that Microsoft were favouring the notification method rather than the 6 digit one.

 

Microsoft Authenticator mandates number matching to counter MFA fatigue attacks | ITPro

 

This ^^

 

One of my Charities fell for a well crafted, automated phishing scheme which captured username, password and a 30 second OTP from an auth token. I assume it was fully automated because the login attempt was recorded at microsoft less than 5 seconds after the firewall logged the phishing page. Fortunately all they did was use it to send a bunch more phishing emails, and it was noticed within minutes and the account blocked and secured.

[howartp]

I read a few months ago that Microsoft were favouring the notification method rather than the 6 digit one.

 

Microsoft Authenticator mandates number matching to counter MFA fatigue attacks | ITPro

That article is not referring to TOTP codes being bad; it's referring to a barrage of push notifications where the victim gets fed up and hits 'Yes'; by adding a number that times out after 30 seconds (whether by number entered into authenticator, or by TOTP) they can't accidentally allow the attacker in.

[enjay]

Fortunately all they did was use it to send a bunch more phishing emails, and it was noticed within minutes and the account blocked and secured.

 

That's all that's happened in any of the phishing attacks I've seen people caught in here too. No actually destructive payload, so was the point of the attack? Was it just to see if they could do it? Would something worse be coming down the line later if the account remains accessible? Are the attackers looking for a specific thing (e.g. the user with a Word doc of all their passwords, bank details, etc.) and will just keep going until they find that person?

[free780]

That's all that's happened in any of the phishing attacks I've seen people caught in here too. No actually destructive payload, so was the point of the attack? Was it just to see if they could do it? Would something worse be coming down the line later if the account remains accessible? Are the attackers looking for a specific thing (e.g. the user with a Word doc of all their passwords, bank details, etc.) and will just keep going until they find that person?

 

If they are able to steal a token. They may find a remote access system and gain access. This access may be sold on the dark web. The phishing may just propagate to contacts.

[ITGuyNW]

Silly question..

 

If you were rolling out the Google Authenticator app, would you advise them to use their own gmail account to sign into the app or a school one?

[howartp]

Silly question..

 

If you were rolling out the Google Authenticator app, would you advise them to use their own gmail account to sign into the app or a school one?

Sensible answer: School account.