MFA not required after initial setup/login

フォローする

New post

Steve Rudometkin

• 2022年01月12日 20:10

I will be setting up MFA for all of our users of BOX

I setup my account first, setup my google authenticator, then typed the code.

I then logged out, and logged back in again, and it DID NOT PROMPT me to type MFA again.

I used the 'chat feature' here on box, and was told that this is a 'feature' of how box uses MFA, and that it will cache it indefinitely for the user on their browser.

I see this as a security risk, and how it goes against usage of MFA to validate it is the actual user.

Is there a way to get this fixed so we actually use MFA to validate the user?

1

• 

  Brandon Ponzio

  • 2022年01月31日 18:19

  I am also having this issue, though I haven't spoken to support about it yet. This defeats the entire point of MFA..

  0

  コメントアクション パーマリンク
• 

  Sam Pollard

  • 2022年02月21日 16:25

  Having the same issue with my usual browser (Chrome), I downloaded Mozilla/Firefox and tested it from there and it did invoke box's MFA/2FA.  I agree that enforcement in Chrome seemed rather lax compared to MFA that I use with other applications.   

  0

  コメントアクション パーマリンク
• 

  Sam Pollard

  • 2022年02月21日 16:35

  Clearing Chome's cache and then logging into box also caused box's MFA to invoke for me.

  0

  コメントアクション パーマリンク

投稿コメントは受け付けていません。