Sign in

Are SMS codes still good enough for MFA in 2026?

Solvedidentitymfasecurity-awareness16 replies · 304 views · started
Reply

Accepted solution

by Anika AdlerJump to the reply

phishing-resistant methods (FIDO2 security keys, platform passkeys, certificate-based auth) bind authentication to teh real site, sooo a proxy phishing page cant relay it... start with admins and finance, then expand. hope that helps :)

lol

  1. Uma S.
    @uma.stone

    Curious how others handled the move away from SMS codes at a place like a hospital IT department. Who got hardware keys, who stayed on app-based approvals, and how did you handle lost devices?

    I'm also curious about what happens when someone loses their phone or key on a Friday evening. How do u handle recovery without creating a backdoor that attackers could abuse?

    thinking

    6
  2. Xavi Ziegler
    @xziegler

    hmmm do your users mostly have company phones or personal phones??

    2 2 helpful
  3. Uma S.
    @uma.stone
    in reply to @xziegler

    ahh right mostly personal phones... some people refuse to install any work app at a hospital IT department. hope thats enough info 😅

    4 0 helpful
  4. Ivan
    @ivan_subnet

    yeahhh pair MFA with conditional access: require compliant or managed devices for sensitive apps, block legacy authentication, and alert on many denied pushes in a short time.

    6 1 helpful
  5. Ivan Larsen
    @shader_sprite

    have u checked ur codes settings? mine were reset after an update. ok this thread just saved my weekend worked for me anyway 🤷

    2 1 helpful
  7. Uma N.
    @uma_quiet

    oof SMS is better than no MFA, but its vulnerable to SIM swapping and real-time phishing, treat it as a fallback, not teh primary method. lmk how it goes

    4 2 helpful
  8. Ivan
    @ivan_subnet

    ahh classic plan recovery before rollout: at least two registered methods per user, a verified identity process at the helpdesk, and temporary access pasess instead of just disable MFA for a day.

    6 0 helpful
  9. Anika Vance
    @anikav548

    yeahhh number matching plus showing app and location in teh push prompt dramatically reduces blind apprvoals. Most major identity providers support it; enable it before considering anything more expensive.

    4 2 helpful
  10. Anika Adler
    @regexprobe
    Accepted solution

    phishing-resistant methods (FIDO2 security keys, platform passkeys, certificate-based auth) bind authentication to teh real site, sooo a proxy phishing page cant relay it... start with admins and finance, then expand. hope that helps :)

    lol

    0 5 helpful
  11. Kira Haddad
    @kirah363

    @regexprobe what did u end up doing in teh end ?

    0 2 helpful
  12. Ivan Larsen
    @shader_sprite

    which version are you on? lmao make a backup before u touch the cable, learned that teh hard way ?

    0 2 helpful
  14. Greta Duarte
    @gduarte

    oh ive been there lol pro tip: write down what u change. i didnt and had to redo hospital from scratch worked for me anyway 🤷

    6 0 helpful
  15. Nina Demir
    @patch_fiddler

    hardware keys get lost constantly in some environments. app-based number matching may be the better default for a hospital IT department. but hey ymmv

    1 0 helpful
  17. Uma S.
    @uma.stone
    in reply to @regexprobe

    @regexprobe dude rolling out passkeys in phases, starting with IT. So far fewer complaints than with SMS codes. seriously made my day 😭🙏

    8 5 helpful
Read next · Defensive Security & Access Management
who keeps locking out a remote salesperson? the hunt for a ghost device
Solved · 8 replies
Read

Reply to this topic

Sign in or create an account to reply.