nigel on Nostr: Someone I know is battling with their work over the 2-factor app they want to put on ...

Someone I know is battling with their work over the 2-factor app they want to put on all employees private phones. I had a couple of comments when they told me...

a) They aren't paying for the devices, so why should they be putting anything on someone's personal device?

b) How can they guarantee the device is not compromised in any way?
Some of the staff have older phones or just don't bring them to work - which they've been told to suck it up because even if they can't install the app due to and outdated phone:

c) they'll do sms 2 factor for those folks.
WTAF.

It feels like this Microsoft pushing provider they changed to, is just trying to check boxes instead of doing what works best for the client. Like also forcing them to use Edge instead of chrome even though the website the have to use fir paet of their job doesn't even work on Edge... and most of the staff just installed chrome to be able to do their jobs. Somehow installing chrome gets around the administrator requirement for installing too, which amused me immensely.

My #security thoughts are: if you make it so staff can't do their job, and they go around your restrictions in order to actually do work, then you've actually increased attack surface by unknown amounts, and made the site less secure.

But I don't work in IT, so WTF would I know.