Post

Second of four on MFA by moment. Account verification. A help desk agent picks up. Someone says they are locked out, and the agent has about a minute to decide whether the voice is who it claims. Most shops text a code to the caller's phone.

Avatier

@avatier.com

That works right up until the phone is the thing the attacker already controls. Account verification is the moment where the user has nothing yet. No session. Often no enrolled device. Whatever proves them has to work from a standing start. That is what separates it from login.

16/9/26, 11:32 am0 reposts0 likes

Avatier

@avatier.com

16 Sept

It has to survive a new hire on day one. A contractor whose phone is not a company asset. A frontline worker who cannot carry a phone into the area. And the caller who could be anyone. The Identity Challenge Card puts the question somewhere else. The agent reads a coordinate.

Avatier

@avatier.com

16 Sept

The caller reads back the word in that square. That value is spent once it is used. Above: the card mid-challenge, one square spent. Never online, never on a device. Knowledge questions can be researched. The service desk has been carrying that risk for years. Pick per moment, not per company.