Document which authentication methods to use - Githubissues

alan-turing-institute / data-safe-haven

https://data-safe-haven.readthedocs.io

BSD 3-Clause "New" or "Revised" License

57 stars 15 forks source link

Document which authentication methods to use #2145

Closed jemrobinson closed 1 month ago

jemrobinson commented 1 month ago

:white_check_mark: Checklist

[x] I have searched open and closed issues for duplicates
[x] This is a request for a change to documentation
[x] This isn't a feature request or bug report
[x] This isn't an open-ended question (open a discussion if it is).

:ledger: Where is the problem?

Currently we state that the following methods should be enabled

Microsoft Authenticator
SMS (SSPR + MFA)
Voice call (SSPR + MFA)
Email OTP (SSPR only)

Given the options here

Screenshot 2024-08-20 at 11 25 26

and thinking about the weak security of phone numbers, we should probably instead recommend:

Microsoft Authenticator
SMS (SSPR only)
Email OTP (SSPR only)
Third-party software OATH tokens

:memo: Required documentation changes

This needs to be tested and then the documentation should be updated

jemrobinson commented 1 month ago

Closed by #2147