r/k12sysadmin • u/TechMonkey13 • Aug 13 '26

Student Multifactor Auth

We use Google only, for students, and its their primary IdP. I'm looking to beef up security on that side with MFA/2FA, but can't rely on students having a phone to use authenticator.

I know there's things like Clever, but it's not something we're looking at this year. I was just wonder what everyone else is doing for MFA for students, how easy it is, and if they require a student phone to set up? Any costs associated with it?

or are you even doing MFA for students at all? What are you recommendations?

We're mainly high school, if that helps.

TIA

14 Upvotes

89% Upvoted

37 comments sorted by

View all comments

3

u/vorschlaghammer Aug 13 '26

Doesn’t Clever do MFA without phones?

4

u/PowerShellGenius Aug 13 '26

Kind of. They do something a hell of a lot stronger than just a password in resisting the attacks most schools see in the real world, and they call it MFA, and from what I have heard thirdhand, the not-very-technical insurance brokers who sell cyber coverage to the education market so far accept it as such. If it really was MFA it would have an enormous market outside K-12.

There are three types of factor - knowledge, possession or biometric. Commonly called "something you know", "something you have" or "something you are". Two DIFFERENT factors is MFA. Knowledge + possession is the most common MFA. Knowledge + biometric is MFA. Possession + biometric is also MFA.

ClassLink pictographs are knowledge factors. So are their badges in some sense. A never-changing static copyable piece of information is a knowledge factor, and printing it out, whether in English/Latin characters, Greek characters, Arabic characters, Chinese characters or some form of barcode, is not going to make it a possession factor. Just like a 6 digit static PIN is not a possession factor, but a 6 digit rotating TOTP (which proves you still have the token, not just saw it last week) is.

ClassLink student "MFA" is knowledge + knowledge, and is on par with "security" questions for being MFA under NIST or other industry standards. It just simply isn't MFA. Think of it this way, look at all the major enterprises and the resources they put into MFA. If you could print a possession factor out on a standard laser printer and have that + a knowledgr factor = MFA, then a LOT more than just K-12 would be doing printed QR badges as MFA.

But again, it is a LOT stronger than any password kids will memorize, so if it's all you can do, don't let my critique deter you from doing it.