2

I work as an IT manager and I have access to the IT systems where 2FA is used.

Currently the 2FA authenticator is installed on my personal phone.

Is it a good idea to ask my employer to provide a work phone where I can keep a backup of the authenticator, just in case if my personal phone stops working, I have a backup 2FA?

Thanks.

8
  • 1
    Yeah. You need to have a secondary contact who you can call to resolve losing your phone. If for some reason you really want a second device, a RSA fob is a cheaper option. Jun 26 at 16:05
  • 3
    And people are going to say that using your own phone is bad. I disagree. If it's convenient for you to have on the one phone, I don't see a problem. Jun 26 at 16:07
  • 2
    It is bad to use your personal phone for work. There are tons of articles about the reasons why. If your employer doesn't agree (that is, if they want you to use your personal phone), that doesn't make it a good idea – it's still a bad idea.
    – Kaan
    Jun 26 at 16:13
  • 3
    I wouldn't say that using a 2FA authenticator app on your personal phone counts as work. With respect to security considerations, I'd argue you're more likely to misplace a second phone if all you use it for is 2FA. Jun 26 at 16:20
  • 5
    @kaan, there are tons are articles purporting that the earth is flat. Volume of information is a poor indicator of usefulness.
    – Tiger Guy
    Jun 26 at 19:40

7 Answers 7

5

If your personal phone is lost/broken/etc, then you can just get the 2FA reset. Your IT department should be able to do this, and if not then whatever the third-party system it will have some process. Most people don't have a secondary device setup for 2FA (and not all systems even allow you to do that).

If you're concerned about this, it may be possible to backup your 2FA codes (some apps like Authy or AndOTP support this) - just make sure that you keep the backup secure.

Whether you should use your personal phone for 2FA in the first place is a separate question. If it's just TOTP codes than that's a bit more reasonable (as you can choose the app, and no network access/traffic is required). If they need a specific app (such as Microsoft Authenticator) installed, then it's up to you to decide whether you're happy with doing that on your own device, and your IT department to decide whether they'll allow you to. But that's a separate topic and one that's been discussed before (such as here).

1
  • With my app, the company can just stop sending authentication requests to my phone. No need to delete anything. And I can install the app on a different phone, with no effect until the company sends a QR code to my computer.
    – gnasher729
    Jun 28 at 20:36
2

Is it a good idea to ask my employer to provide a work phone where I can keep a backup of the authenticator, just in case if my personal phone stops working, I have a backup 2FA?

I would ask for a work phone so that you can do work on the work phone, and keep the personal phone for non-work activities. That is more secure for the company because they can dictate the applications on the work phone, and can make sure that all security policies are being followed. It also keeps work documents off of non-work hardware.

7
  • Agree with you!!
    – Chris
    Jun 26 at 14:42
  • I'm confused why this post – along with many others around here – get down-voted. With this specific example, this answer is great, and it's what many companies themselves set as policy. What is there to downvote? That someone doesn't like the answer? I'm scraching my head with understanding how this community works.. lots of downvotes, comment removal, and general negativity toward good answers+comments.
    – Kaan
    Jun 26 at 16:06
  • 2
    I didn't downvote but my guess is that it doesn't answer the question. The OP is worried about being unable to access their network if their phone stops working. Having a single work provided phone doesn't help with that, even if it may (or may not) be good for other reasons. Jun 26 at 16:47
  • @Kaan presumably because, although storing work documents on a personal phone is a very bad idea, that's not what the question is actually asking about. There's a huge difference between using a personal phone for TOTP and having your work email on it.
    – Gh0stFish
    Jun 26 at 16:54
  • 3
    @Kaan The question is asking about having a second phone for redundancy. This answer does not address that. Jun 26 at 17:29
2

2FA has exactly one purpose: At some point in time a message is sent to a phone that is supposed to be in your possession, YOU (and nobody else) pulls that phone out of their pocket, and somehow acknowledge that you received that message. How owns the phone is irrelevant for this purpose, the only thing relevant is that you are in physical possession of the phone. Nothing is ever stored on your phone. There is no reason whatsoever why the company would ever want access to your phone.

People discuss whether you should use your private phone for work purposes. In this case, doing 2FA on my private phone saves me from having to carry two phones. The wear and tear on my phone and cost of data is less than any rounding error. So personally, for this purpose I would very much prefer using my own phone instead of having to use a second phone.

There are people who use a phone for significant amounts of work. Like having phone numbers of hundreds of customers and so on. That kind of thing should be done on a separate phone supplied by the company. Work emails have never been on any phone in my possession, private or work, but on a computer. But for 2FA and 2FA alone that's not a reason.

If you lose the 2FA phone, whether it's your private one or one supplied by the company makes no practical difference (assuming you would have lost that phone anyway, and it's probably more likely to lose a phone if you have two phones in your pocket instead of one). Having a second phone just to avoid interruptions when your personal phone breaks is not worth it. And if you want a works phone for this person only then at the time your private phone breaks, your work phone will be somewhere in a drawer and you can't remember where, you won't know where the charger is, and so on.

1

Is it a good idea to ask my employer to provide a work phone where I can keep a backup of the authenticator, just in case if my personal phone stops working, I have a backup 2FA?

Rather than asking for a new device I would speak to whomever implemented and manages your company's 2FA.

Ask them what happens in the case where the 2FA device ( it doesn't matter if it is personal or company provided ) is lost or stops working. Let them decide how this situation is handled and then simply follow through with that. If that means that the company needs to provide a "backup" device then that is the solution.

1
  • 1
    Any medium sized company would have a drawer full of old but working phones. I have a drawer full of old or working phones. So there should be minimum disruption if your phone breaks or gets lost.
    – gnasher729
    Jun 28 at 20:20
0

This won't work in 100% of cases, but if standard 2FA is used (i.e. not a proprietary/custom 2FA technology), Microsoft Authenticator has a feature to back up against a nominated account.

To echo a previous answer, depending on what the service is (i.e. Azure AD), your IT department will have ways and means to reset various security concerns with regards to your login.

This doesn't answer your question re: "should work give me a mobile phone". As an employee and a manager, you probably should be issued a mobile phone, but not just for the reason you've stated. If you're expected to make phone calls for the company and have constant access to work emails, it could be argued that the company should foot the bill for the phone calls and the internet access respectively. This is a typical arrangement, especially in larger organisations.

-2

To start with, I think it is not good practice for you to use a personal device for a thing like this. But I guess the company doesn't mind which makes it the more worrisome.

That being said like someone already pointed out earlier, you should be able to recover your account with the help of an admin which I'm guessing you're not.

1
  • 3
    Please explain what benefits you would have and why 2FA on your private phone would be "worrisome".
    – gnasher729
    Jun 27 at 15:53
-8

Yes. Technically speaking your phone is your phone. not office phone. They are not supposed to use your phone for office purposes.

But countries like India, office takes employee-s personal time, belongings for granted. Especially because no employee complains. So, first thing is for you to see the practice in your company, in your region, in your friends circle.

I would suggest you to weave a story why its important for the company to give you official phone (example: Your 2y niece uses your phone to play and in the past he has broken it. It takes you 3-4 months to get a new phone; research etc.. )

[edit1] Between, you can use Google Chrome/ Firefox plugins for authenticator. Or Bluestax android and get a virtual android phone on your laptop --subject to office security policy

4
  • Totally agree with your points. But the last point where you said to use Bluestax android/emulators defeats the purpose of the 2FA because 2FA is suppose to be on a difference device for security purpose.
    – Chris
    Jun 26 at 14:42
  • 5
    Making up lies to try and get something from your employer is rarely a good idea.
    – Gh0stFish
    Jun 26 at 16:55
  • The only thing that you can do with any 2FA tool is acknowledge that YOU, as a person, received a message that was sent to a device supposed to be IN YOUR POSSESION. It doesn’t matter if that phone is not secure, as long as it is in your hands.
    – gnasher729
    Jun 28 at 13:54
  • Chris, it doesn’t have to be a different device. It just has to be on a device in my possession. I can log into some accounts from anywhere, but 2FA only works on a designated device. Logging in and authentication on the same device is no problem, because a thief who knows my login and steals my designated device can login from anywhere; the fact that both devices are the same makes no difference.
    – gnasher729
    Jun 28 at 13:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .