Salesforce To Require MFA For All Users Starting Next Month (therecord.media) 56
An anonymous reader writes: Salesforce, the world's largest customer relationship management platform, said that customers must have a form of multi-factor authentication (MFA) turned on starting next month, or they won't be able to access their accounts. "Beginning February 1, 2022, Salesforce will require customers to use MFA in order to access Salesforce products," the company said last month.
Salesforce said that users will be able to choose from using security keys, an authenticator app, or an OS biometrics systems to secure accounts. MFA solutions that rely on sending one-time passcodes via email, phone, or SMS messages won't be allowed "because these methods are inherently vulnerable to interception, spoofing, and other attacks," Salesforce explained.
"We encourage users to register multiple verification methods so they have a backup in case they forget or lose their primary method," the company added.
Salesforce said that users will be able to choose from using security keys, an authenticator app, or an OS biometrics systems to secure accounts. MFA solutions that rely on sending one-time passcodes via email, phone, or SMS messages won't be allowed "because these methods are inherently vulnerable to interception, spoofing, and other attacks," Salesforce explained.
"We encourage users to register multiple verification methods so they have a backup in case they forget or lose their primary method," the company added.
This being Slaseforce... (Score:3)
Re: (Score:3)
I already have plenty of users who will blindly click on anything that pops up on their phone, so while I applaud the deployment of MFA, it's not the cure-all everyone seems to think it is.
Re: (Score:2)
They'll be able to publish your full biometrics now.
Re: This being Slaseforce... (Score:4, Funny)
It was fucked up 5 years ago when the first line of code was written for this.
Who's winning here? (Score:2)
Sharing deterrence (Score:4, Informative)
Re: (Score:3)
Passwords have been a flawed authentication mechanism since its inception. Even back in the days of dial-up modems, places either did two tier passwords, dial-back (where the company's modem would dial your number after you logged in and hung up.) During the 80s and early 90s, one time passwords with S/KEY were used so at the minimum, a sniffed telnet connection wouldn't glean a password, while everything else was fair game.
We have been lucky so far... but the gravy train of just using a password has ende
Re: Sharing deterrence (Score:1)
A Masters of Fine Arts? (Score:3)
Re: (Score:3)
Re: (Score:2)
Real nerds have one of each possible degree. ;-)
Re: (Score:2)
Excepting those having to do with Physical Education.
Re: A Masters of Fine Arts? (Score:3)
Look, I managed to get the ACM computing competition count for an athletic letter in high school since I had surgery for carpel tunnel syndrome and could show physical injury. Show me your phys Ed degree requirements⦠I bet we can game the system and earn one with an XBox!
Can't actually have multiple of the same method (Score:3)
Their claim in their announcement:
"We encourage users to register multiple verification methods so they have a backup in case they forget or lose their primary method," the company added.
Their actual documentation ( https://help.salesforce.com/s/... [salesforce.com] ):
You can register all supported verification methods and use them to log in to Marketing Cloud. However, you can register only one method per verification method type at a time. For example, you could register a single authenticator app and a single security key.
So you can't have the authenticator app on your phone and on your tablet, say, as a backup for when your phone dies or is stolen. That is not very useful, and it is a very common problem with MFA systems (Okta, for example, has the same limitation). They just don't understand that your backup may be a different instance of the same method.
You can, of course, hack it by saving the authenticator app seed and using it to initialise several authenticator instances, but that is neither easy for the average user nor best practice because if someone can steal that seed from where you saved it then you're 0wned.
Re: (Score:2)
Re: Can't actually have multiple of the same metho (Score:2)
Google Authenticator can generate a QR code that another instance of it can use to generate the same codes. I just used that feature to move my authenticators to a new phone -- they continue to work from the old phone as well.
(After I did this, the app shows have a very prominent banner that codes were recently exported, protecting against someone trying to sneak them off. I'm not sure how long that will stay.)
Re:_Can_ actually have multiple of the same method (Score:2)
They offer TOTP as one of the options. That can be registered easily with multiple devices, and the content can be backed up.
Personally, I use Aegis, because it supported export/import before Google did.
At least the methods are sane... (Score:2)
At least they have two methods that are known and good... the standard TOTP authenticator app, and a FIDO key.
I like "packing my own parachute" when it comes to an authenticator app, and using one that doesn't just sync among devices, but can back itself up, as well as export the FIDO shared secrets in plaintext, should I want to use a new app. A Yubikey or similar is also nice, just because you can configure the device to prompt for a PIN before giving access, thus creating CAC/PIV tier security.
At least,
Re: (Score:3)
This is one reason why I tell people to not use Authy, Google Authenticator, or other 2FA managers where backing up and syncing isn't possible. In fact, I had a closed sync manager actually corrupt all my MFA seeds. An offline device in airplane mode saved me, and I was able to redo all my 2FA seeds.
There are good 2FA managers which allow for syncing, backups, exports (so you can copy the seeds to other applications.) A few I've used: BitWarden, 1Password, Codebook, enPass, SafeInCloud, and for local st
Unsupported MFA methods (Score:1)
Interesting what types of MFA they are not allowing [salesforce.com]:
Which verification methods satisfy the MFA requirement?
Let’s start with verification methods that don’t satisfy the requirement, whether you’re using your SSO identity provider’s MFA services or Salesforce’s MFA for direct logins.
o Delivering one-time passcodes via the following options isn’t allowed because these methods are inherently vulnerable to interception, spoofing, and other attacks.
- Email messages
- Text messages
- Phone calls
o Security questions
o Used on their own, trusted devices, trusted networks, or VPN aren't adequate verification methods for the MFA requirement. (But when trusted devices and trusted networks are used in combination, you can achieve MFA and satisfy the requirement.)
Re: (Score:2)
How many US banks support TOTP? They mostly require you install their bank's app for 2FA.
This might kill their business, as (Score:2)
scammers and spammers are a large portion of their "customers".
Bigger problems (Score:2)
"We encourage users to register multiple verification methods so they have a backup in case they forget or lose their primary method," the company added
If you, as a company, forget or lose your verification information, you have bigger problems. There should never be a time a company doesn't have its login information for any service. It should be stored in multiple locations with access by multiple people so it's available at all times.
it's plain incompetency if this simple act isn't done.
Re: (Score:2)
Isn't that what an enterprise PAM is for? For example, if a company has a generic "admin" account used for services, for example, the MFA root user, having the user's password and 2FA seeds in something Devolutions Vault can be set to grant permissions to those who need it. For a small company, this could be as simple as 1Password, BitWarden, or LastPass.
Re: (Score:2)
I've wondered about some standard for recovering lost account info. It definitely wouldn't be one mechanism, but consist of a number of different ways with different weights. For example, one "absolute" way would be to send a registered mail with an auth code in it. Since receiving it requires not just picking it up, a physical ID, and a signature, it is as secure as one can get for a method. Or multiple ways, be it signing a random message with your GPG key and pasting it, a recovery code from a list,
Re: Bigger problems (Score:2)
I used to work for a big Swiss bank, and we used the registered mail technique for distribution of MFA tokens (well, activation keys printed on paper; same same, but diff).
Now I work for a big but not as big Nordic bank, and up here we leverage the government ID system - which is administered by the banks. Same deal though - we require physical presence with ID in a branch or a letter sent to your address (though, off the top of my head, I donâ(TM)t know if we send it registered - I should check).
MFA? (Score:3)
A Masters of Fine Arts? Seems like a weird requirement for their users. :-)
Re: (Score:2)
Re: (Score:2)
Master of Fine Arts? (Score:2)
What ever happened to calling it 2fa?
Re: (Score:2)
What ever happened to calling it 2fa?
Not Web3 enough.
Re: (Score:2)
It wasn't confusing enough. And before anybody defends that stupidity by saying "MFA can be more than 2FA", the phrase "requires 2FA" implies a minimum and that two or more factors would work. If they're requiring more than two, they could say NFA. until they reached the appropriate threshold of N but no(lots of Os)o. Let's overload a commonly used term so we can write headlines that look crazy.
Oh, for the love of $diety, Slashdot. How does my post look like ASCII art? You've got actual nazi trolls tha
Wish there were better options .... (Score:2)
I guess I'm "old fashioned"? But my experience with 2FA/MFA is that it's just a huge headache for I.T. staff to support for the average users, and it gets hacked occasionally anyway. One of the big problems is, many users opt for SMS text PIN codes to be sent to their phone. It's the most obvious way to receive the code, since almost everyone knows how to get a text these days. But there are all sorts of ways to compromise that, up to and including tricking the phone carrier into porting your number over t
Re: Wish there were better options .... (Score:2)
The point about shared accounts is actually a design feature of MFA, not a flaw. And the first point about improper implementations is⦠just that. Poorly implemented MFA.
Re: (Score:2)
Probably no point replying to the person who insists on posting anonymous to start with?
But you sound like the typical script kiddie type who "lulz" at anyone complaining an implementation of something is "too difficult", because of course, YOU can navigate it just fine!
I've done I.T. for 30 years now and I know enough to not claim I "have the solution" to a lot of difficult problems. But I do have a feeling we're going about this all wrong when we add so much complexity, a person can't even get signed in t
Not about security (Score:1)
Saleswhores (Score:2)
The world is better off if fewer people can login and use Saleswhores.
MFA final nail (Score:2)
MFA is the final nail in the coffin of online access to banks for me. It is FAR FAR faster and more convenient to get paper statements and scan and OCR them than it is to deal with banks' ridiculous TFA systems that invariably force you to end up calling customer service in India, wait on hold for 20 minutes, and then the moron at the other end can't figure out what's wrong anyway.
Re: (Score:3)
It is FAR FAR faster and more convenient to get paper statements and scan and OCR them than it is to deal with banks' ridiculous TFA systems that invariably force you to end up calling customer service in India, wait on hold for 20 minutes
WTF is wrong with you. My own mother has no problems using MFA to login to online banking and this is a woman who one day asked me for help because the screen "wasn't working" on a computer she hadn't actually turned on.
Most normal people can't even walk to the scanner in the time it takes to login via MFA.
Cisco? (Score:2)
As far as I understand, MFA is a trademark of Cisco. They have somehow implement the worst two factor authentication I have the displeasure of using. Microsoft and Google are positive user-friendly by comparison.
Hahaha (Score:2)
I thought that MFA is suppose to make you more secure. Adding these make it seem less so
'Required' vs. 'Enforced'. (Score:1)