hardware keys for everyone: realistic or fantasy?

Dima Zhang · 2026-09-10T14:23:40.044Z

ugh. were a 50 person company and use number matching for MFA today. After hearing about push bombing attacks, Im wondering whether were as protected as we think. Users approve things without reading, and phishing kits proxy everything anyway. Whats a realistic next step that wont cause a helpdesk riot?? we dont have a big security team... its baiscally me and one colleague, plus a helpdesk that already handles a lot of password resets. whatever we choose has to be supportable by a small team,…

identity mfa security-awareness7 replies · 62 views · started last mo.

Dima Zhang
@thread_garage816
24 rep · 8 posts
last mo.
ugh. were a 50-person company and use number matching for MFA today. After hearing about push-bombing attacks, Im wondering whether were as protected as we think. Users approve things without reading, and phishing kits proxy everything anyway. Whats a realistic next step that wont cause a helpdesk riot??

we dont have a big security team... its baiscally me and one colleague, plus a helpdesk that already handles a lot of password resets. whatever we choose has to be supportable by a small team, not just secure on paper. seriously need help here 😭

6
Liv Fontaine
@liv.fontaine0
51 rep · 3 posts
last mo.
wait is legacy authentication (old mail protocols) still allowed? ??

6 0 helpful
Ruben M.
@luckyworks
45 rep · 4 posts
last mo.
idk man that sounds like bad advice tbh

2 3 helpful
Dima Zhang
@thread_garage816
24 rep · 8 posts
last mo.in reply to @luckyworks
ok so finance and the two admins... everyone else has fairly limited access.

5 0 helpful
Fenna R.
@fenna_lambda
47 rep · 7 posts
last mo.
ok so plan recovery before rollout: at least two registered methods per user, a verified identity process at the helpdesk, and tmeporary access passes instead of just disable MFA for a day. fingers crossed 🤞

0 6 helpful
Lars T.
@tensorhound-3oe
70 rep · 8 posts
last mo.in reply to @fenna_lambda
same tbh

6 0 helpful
Rafa
@uplink_fox
98 rep · 7 posts
last mo.in reply to @tensorhound-3oe
lol same thing happened to me pair MFA with conditional access: require compliant or managed devices for sensitive apps, block legacy authentication, and alert on many denied pushes in a short time. hope that helps :)

36 0 helpful
Joon Celik
@voxelprobe
36 rep · 5 posts
last mo.
Phishing-resistant methods (FIDO2 security keys, platform passkeys, certificate-based auth) bind authentication to the real site, so a proxy phishing page cant relay it. Start with admins and finance, then expand.

1 5 helpful

Reply to this topic