3

I'm looking into MFA options for a group of around 1000 people. Duo is intriguing, but I'm not sure I'm comfortable implementing something that incorporates text messaging (in contrast to something like WiKID which has only a passcoded app + OTP).

Does anyone know how Duo has designed their platform to mitigate SIM swap attacks? The auth mechanism baked into the application itself could certainly be hardened for it, but there seems to be a fair amount of "fallback" SMS stuff that goes on with it.

  • Duo supports many types of multi-factor authentication, please be specific about which type you're referring to. – AndrolGenhald Nov 8 '18 at 14:49
  • Specifically the SMS option - from their website: "...Duo Push, sent by our Duo Mobile authentication app, allows users to approve push notifications to verify their identity. We also support Universal 2nd Factor (U2F), security keys and tokens, one-time passcodes (OTP), SMS and phone callback to provide flexible options for all types of users...". I've only used Duo for a couple hours, but It seems to be an optional auth method users can select as well: help.duo.com/s/article/1443?language=en_US – Server Fault Nov 8 '18 at 15:00
  • 1
    I think each DUO administrator can decide what methods of authentication are allowed. For example, one institution I worked for allowed phone calls while another one does not. Neither has allowed text messaging (DUO Push has been permitted). – Allen Howard Nov 8 '18 at 15:24
  • @AllenHoward Good to know. Were you aware of any specific reasons/concerns SMS was disabled for these installations? – Server Fault Nov 8 '18 at 16:43
  • @ServerFault, I am not-- I don't know if they didn't subscribe to the feature (if it was added cost), or if they just deemed it unnecessary since we would have the DUO app on our phone to generate a code. – Allen Howard Nov 8 '18 at 18:19
1

With Duo one can disable the SMS fallback option in the admin panel (this is according to documentation I haven't tested this to confirm they actually disable it). If push is an option I recommend it (just make sure you train users about getting double push notifications and how this can be a sign of nefarious activity). Documentation below.

https://duo.com/docs/administration-settings#restricting-authentication-methods

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.