Hacker News Reader

Comment by justin_oaks | Hacker News Reader

I once had a coworker who refused to install a two-factor code generator (such as Google Authenticator, but there a dozens of alternatives) on his personal phone. I told him that he could generate codes any other way he likes, but the personal phone would be easiest.

He wouldn't have lost his job but he wouldn't be able to gain production access, which required two-factor codes.

He grudgingly installed a two-factor app. I'm sympathetic to the idea of "don't make me install stuff on my phone", but when it can be one of several apps, and the sole purpose of the app is retain a cryptographic key and run some hashes on it... I lose most of my sympathy.

I suppose it'd be nice if that employer (I no longer work there) provided a device to generate the two factor codes, but I can understand why they don't.

View on HN

> but when it can be one of several apps, and the sole purpose of the app is retain a cryptographic key and run some hashes on it... I lose most of my sympathy.

I can't see how having a choice of apps changes anything.

An employer shouldn't be able to demand an employee to use personal property for work purposes against the employee's will. That's unreasonable, unacceptable and ethically wrong in my opinion.

> I suppose it'd be nice if that employer (I no longer work there) provided a device to generate the two factor codes, but I can understand why they don't.

I mean... aren't there quite literally devices whose sole purpose is to generate 2FA codes? Something with a form factor similar to a small keyfob?

I do know these exist but I've personally never seen one "in the flesh". Also I can only imagine these (as a singular solution for all relevant employees) would probably also be easier to administer than a wild growth of different 2FA apps, most likely on different OSs and even different versions of those OSs, while over the years the churn of employees means the variation gets ever larger.

I used to have to carry around an RSA keyfob to be able to deploy code to production! I've had a few of those at different jobs!

https://en.wikipedia.org/wiki/RSA_SecurID

I've never had a job that required "Google Authenticator" on my personal phone. I guess I stopped working for other people long before that became the main 2fa method. That might be a step too far.

Where I've worked, they will hand out RSA-style tokens that constantly generate new codes if you don't have a phone or don't want to install an app on your personal phone. There are even tokens out there that will totally replace any Authenticator-compatible app since the token is programmable.

> but I can understand why they don't.

And why is that? I don't know of any good reason besides not wanting to spend a trivial amount of money.

I sometimes like to leave my phone at home when I go to work because I want to separate work from personal life. I would probably leave a job that required me to have my phone on me for work.

It's very easy to solve this. Give your dudes a Yubikey and get them to use that. It becomes their responsibility to secure the Yubikey.

Almost everything supports the new ones. And if they don't, use Okta for SSO and Okta supports that.

I find this totally reasonable, especially since you can pick what app you want to install, and _it's actually useful for stuff outside of work_.

For example, Okta Verify or Duo I would absolutely demand a separate phone for paid for by work - they are remotely monitorable/controllable more than local hashing.

But you should be generating TOTP codes for your personal accounts too!

The principle of the issue is requiring personal property for the job when there are well-known, safer alternatives such as the RSA SecureID. What happens if your phone freezes or completely dies? What if an attacker who can access the first factor of authentication can remotely access your phone?

Why risk it?

What happens when your RSA SecurID token dies, the office is closed, no one can provision you a new one unlike a TOTP?

Your RSA SecureID being the point of failure is much more rare and much more harmless than your phone being the point of failure.

Then work supports it. However great or poor that they do is up to them.

If I let my phone simply run out of battery...

Well, it is my phone. I can if I want to.

If I don't upgrade for 6 years and nothing accepted supports my version of OS...

Well, it is my phone. I can if I want to.

As soon as you make my phone a part of your business, it is no longer my phone.

At least with duo you can have it just call a number. No app needed. Which is hillarious to see in a hospital setting. Get duo push from the desktop, the handset installed next to the desktop is often the one to ring. It stops being two factor when you can control both factors with one butt in one seat.

Reply on news.ycombinator.com