Hacker News Reader

If you work for Microsoft (I do) that doesn't sound right. There are times when I get 2FA but not often on my work machine. Microsoft employees get a smart card and if your machine has a TPM chip you can create a virtual smart card accessed with a pin or biometric factor like fingerprint or Windows Hello.

View on HN

I don't use Windows except when interacting with the 15 year-old payroll time entry system. I have nothing nice to say about support for non-Windows users, though most of that is unrelated to 2FA (though supporting U2F would sure be a lot more friendly than proprietary apps that surf on top of the TPM)

No a fan of Microsoft systems, but they have GS-API/Kerberos and AD FS 3. Unix users will want SSH key management, but apart from that, Microsoft made efforts to help people spread single sign-on to much of their infrastructure.

If your payroll system has a web interface, you can have an applicative firewall in front replay your stored credentials as a hacky SSO (after checking your identity another way, of course).

The payroll system, as well as security group / mailing list systems are all completely useless in anything but IE (not even Edge).

And Kerebos does nothing for these 2FA woes sadly.

Reply on news.ycombinator.com