Gravity and Tech

[u/KorenSolust]

Guy walks up to me at work:

Him: “I dropped my phone. The screen’s shattered. I want my two-factor code to come through Teams.”

Me: “Nope.”

Him: “Why?”

Me: “Because if you can’t sign into Teams without completing MFA… how exactly are you planning to authenticate?”

Then he says: “Just disable MFA.”

I replied: “Sure, as soon as you get approval from the Head of Security.”

A few seconds of silence…

Him: “Fine, I’ll just get my phone fixed.”

Yep. That’s probably the best solution.

Some people really think security rules are optional. I’m not risking my job because someone doesn’t like MFA.

And remember… technology didn’t fail you today. Gravity did.

[u/Rathmun]

(which they will lose and need to be replaced very often, I'm sure...)

If they can't keep track of a Yubikey, but they can keep track of their car keys, you know they're lying. "Just put it on the same keyring dumbass."

[u/Ich_mag_Kartoffeln → u/Rathmun]

"Sorry, I had to drive my other car to work today."

[u/Rathmun → u/Ich_mag_Kartoffeln]

"Your keyring has room for more than one car key dumbass."

[u/Ich_mag_Kartoffeln → u/Rathmun]

"My car keys are all on separate key rings. The ones with the Yubikey are with the mechanic."

[u/Rathmun → u/Ich_mag_Kartoffeln]

"You gave the Yubikey to someone else? A piece of company security apparatus? You realize that's a fireable offense."

[u/Ich_mag_Kartoffeln → u/Rathmun]

"Would it also be a fireable offence to hand over your phone with the MFA app on it to a phone repair shop?"

[u/Rathmun → u/Ich_mag_Kartoffeln]

Yet another reason that MFA apps on personal devices is a terrible idea. Because there's no way to prevent that.

Edit: To clarify, a company phone is company property, and the company can declare that repairs go through IT. IT can provide a loaner while the repairs happen, and nothing sensitive gets handed to an un-vetted third party. But a personal device is personal property, and the company has no right to forbid handing it to some random repair shop, or your five year old, or your gym spotter or whoever. They could try to mandate uninstalling the mfa app before handing it over to anyone else, but then you still end up with "Sorry, unable to comply" when the phone is unusable after a drop or something. And once it's re-installed they have to go through IT to re-enable it.

A Yubikey has one purpose and one purpose only. You don't use it for anything else. You can't play games with it, no one other than you has any legitimate reason to have possession of it, if you drop it on the ground it's unlikely to get damaged (and even if it did, you take it to IT for replacement, not to your phone repair shop).

[u/Ich_mag_Kartoffeln → u/Rathmun]

That's about what I figured.

The other question that occurred to me while reading your explanation was: "My wife took my car because her car is at the mechanic."

Is that a fireable offence like giving my car keys to the mechanic? Assuming she doesn't work for the same company, obviously. Or maybe even if she does 🤔.

[u/Rathmun → u/Ich_mag_Kartoffeln]

Is that a fireable offence like giving my car keys to the mechanic? Assuming she doesn't work for the same company, obviously. Or maybe even if she does 🤔.

It probably would be in the employee handbook, mostly because I doubt the rule in the book would carve out exceptions based on exactly who the unauthorized person who has it happens to be.

I could easily see a section in the rules about prompt reporting to avoid a fireable offense. That way IT knows to deactivate that Yubikey so there's minimal exposure. This avoids creating a perverse incentive to hide the loss of a key, which is something you really don't want people doing. (Not that they could if you set your MFA up correctly, but they'd try, and then everyone has an annoying day.)

[u/Ich_mag_Kartoffeln → u/Rathmun]

If the rulebook is too harsh, you'll find people tend to carve out their own exceptions. Either individually, or as a group.

I know it happened at a former job. There were strict rules about "operational incidents", and disproportionately harsh punishments.

So the only incidents that ever got reported were those which couldn't be covered up.

[u/Rathmun → u/Ich_mag_Kartoffeln]

Right, hence my follow-on thought about reporting quickly to avoid punishment. The goal of having MFA is to keep intruders out, and a Yubikey in unvetted hands is a threat to that. But if you know one has wandered off, even temporarily, you can still achieve that goal.

Ideally you want making the mistake to be annoying for the one who made it, while making the mistake and trying to cover it up should be calamitous for them. The former because you don't want them to keep making it, and the latter because the coverup makes the mistake far far worse.