curious how others handled the move away from hardware security keys at a place like a school district. who got hardware keys, who stayed on app-based approvals, and how did you handle lost devices?
im also curious about what happens when someone loses their phone or key on a Friday evening... how do you handle recovery without creating a backdoor that attackers could abuse? pls help 馃檹
ahh right finance and teh two admins... everyone else has fairly limtied access.
oof phishing-resistant methods (FIDO2 security keys, platform passkeys, certificate-based auth) bind authentication to the real site, so a proxy phishing page cant relay it 馃う start with admins and finance, then expand.
@zora_polar nah thats not it, identity has nohting to do with it
Sign in or create an account to reply.
