Transcript
A wafrn woot (post) by @tinker@infosec.exchange saying "Microsoft Authenticator needs me to validate with Authenticator in order to log in with Authenticator to use it to authenticate another app with Authenticator. Here is the app telling me to open itself to validate itself with itself. #infosec #iHateComputers" It has a screenshot showing the microsoft authenticator app.
That's why you always register a second hardware token. Those things could get lost.
I've started employing one physical hardware token as my primary means of MFA and a TOTP or backup codes if the website provides them.
I have two backup hardware tokens (so three total) but it's become impractical to keep them all in sync. And not all websites support multiple hardware tokens.
My initial idea is to have a key locked at home in the event that I lose my primary key. The third was just a spare I got at work.
Also the number of websites that don't have proper MFA that really should amazes me.
E-Trade has that shitty symanticVIP MFA. My primary bank still does cell phone MFA with no plans to do TOTP.
Honestly, the bare minimum should be TOTP.
And remember kids: passkeys by themselves are not MFA.