Multi-Factor Authentication for Developers

fusionauth.io

1 point·mooreds··4 comments

Having MFA as a rule of thumb in an application is good, but it is also assumed we continue to use passwords. I personally preferred offering a passwordless solutions that includes MFA in it than bringing MFA to the picture and keeping the less secured way to authentication alive. Also, an advanced authorization system could take into factor some vectors that traditionally was belonged to MFA and create a better UX with advanced security.

Yes, passwordless is great, whether you are talking about magic links or passkeys. While we are waiting for them to get more adoption, making sure you allow (or require) users to set up additional factors of authentication is a good idea.

> Also, an advanced authorization system could take into factor some vectors that traditionally was belonged to MFA and create a better UX with advanced security.

Tell me more...

Agree, the adoption is the key here.

Regarding AuthZ, dynamic authorization layers that combine policy as code and synchronization engines such as OPAL[1] can make the authentication session smarter and more dynamic to multiple factors. Think of AuthZ layer that combines session geolocation, IP, fingerprints, etc. that enquires every time a new vector needed for the authorization action.

1 https://github.com/permitio/opal

Ah, zero trust by another name.

Sure, makes sense. Agree that level of continuous authorization makes sense. Defense-in-depth to the max.

Reply on news.ycombinator.com