Post

Third of four on MFA by moment. Passwordless login. The test: if the password still works when the passwordless path fails, you did not go passwordless. You added a second door and left the first one unlocked. Attackers do not queue at the new door. This is the highest-volume moment in the set.

Avatier

@avatier.com

17 Sept

Every user, every day. Two things follow from that. Phishing resistance matters more here than anywhere else, because volume is what attackers fish in. FIDO2, WebAuthn and hardware keys bind the credential to the site. A convincing replica of your login page gets nothing worth having.

Avatier

@avatier.com

And friction compounds. Four seconds once a quarter is invisible. Four seconds on every login for every employee is a line item. Biometrics win this moment on devices that already have the sensor. The honest catch: none of this reaches the user with no device to be passwordless on.

17/9/26, 11:32 am0 reposts0 likes

Avatier

@avatier.com

17 Sept

That user is not an edge case. They are a shift. Which is why the list has a printed card on it. Above: a shared workstation. Password accepted, then a coordinate off the printed card and a private PIN, with directory identity resolving on its own. Pick per moment, not per company.