I'd figure out what the least-technical person (with data access) in the company needs to do their job, and find the friction points that prompt this person to find the path of least resistance.
2FA in general makes a bad solution worse all for the sake of security; it's not long for this world.
Can you expand on this?
With reasonable setups (trusted locations and trusted devices) the friction is absolutely minimal. And it isn't even a question, the security benefits are astronomical.
I am not understanding how you can say 2FA is "not long for this world".
2. 2FA way - type email - type password - click submit - switch to secondary email/text app - wait for email/text to arrive - copy text string (not consistent, depends on input method) - switch back to main app - paste or manually type text string - click submit
3. Hybrid (passkey?) setups are a great step in the right direction. Even more convenient than passwords, and more secure, without app switching, which is the huge friction point.
#3 is still MFA.
Enter credentials -> receive push notification and press "yes" -> login.
They wrote #2 to be purposefully long and convoluted. "Copy/paste code" is somehow 5 steps, with a waiting period? We really needed to detail out "switch app" as 2 steps? Come on.
As another example:
If you were to give directions to someone on how to get to your house, do you say: "Turn right at XYZ street, follow that up to ABC street and take a left, last house on the right"
Or do you say
"When you are 50ft from XYZ street, press on the brake pedal. When you get to the corner, turn the steering wheel to the right, hand over hand, then get the car straight again, press your accelerator, approach the speed limit, check mirrors every 20 seconds [...]".
Both are true. One is unnecessarily detailed to make it seem more complicated than it is.
Imagine needing two apps to login to one app
Do I need to go back and explain how the computer chip is made and what transistors are, too?
Or maybe we start at the part where you have to find a store to purchase a phone, and walk through that process?
I've been using it for a few months and it works very well.
I have not tried to set up MFA for someone with memory deficits, so I can't speak to that.
All of that is completely beside the point, though. I'm not sure why it matters. There is 0 chance that MFA is "not long for this world".
Imagine futuretopia with me for a moment; when you are hired at a company they send a very secure cryptographic keygen to your subdermal ID implant. Maybe with 3 different fields for "employee" "division" "role"
When you enter the building, implant comms automatically using "employee" with the mantrap pads acting as a second factor as you type in your yearly revolving 9 digit employee passcode
Same with the workstation when you log in using "division", and maybe when you specifically access certain files "role". They all last a user session length, and can all use the employee 9 digit as primary login
This scenario gives you effortless 2 factor, 3 different times, and the employee only has to put in their simple 9 digit code thrice daily, maybe 6 times account for lunch break.
Does this scenario seem like two factor that's on the way out and causing more problems and inconvenience than it's worth?
Two factor sms where you have to type the code in yourself and sms is insecure? Sure that's dog shit. But we can make a better future instead of disregarding a pretty solid security concept
This is immediately the wrong design and is confusing authentication with authorisation.
Your "subdermal implant" needs only one feature, (two if we wanted greater privacy than exists for employees today, but let's not get ahead of ourselves)
1. "I am still me". The implant can produce a copy of its public key, and will cheerfully sign simple freshness challenges allowing the employer to confirm that this is the same implant that the person hired had.
That's all you need, that's the whole thing. The question of whether you're in Org Unit A9 or ZQ, whether you're a Deputy Senior Assistant or a Senior Deputy Assistant, whether you're part of Divison F or not, these aren't authentication they are authorisation questions and there is no need for them to belong to you, they can live near the decision since they can be changed by other people - you can be demoted or promoted, moved, reshuffled, fired - that's not a decision for you it's a decision for somebody else.
Most average people are just confused by it, but it's so important for security the focus shouldn't be getting rid of it, but figuring out how to make it buttery smooth to use.
Yes, and given all the recent examples of accounts hacked because they didn't have 2fa for the sake of convenience, it's worth it.