Delta website MFA config area, showing: Push Notification, Text, Email

Notices where this attachment appears

1. Embed this notice
   Royce Williams (tychotithonus@infosec.exchange)'s status on Tuesday, 18-Feb-2025 03:55:22 JST Royce Williams

   Delta Airlines recently announced that they added MFA, to both their site and their app.
   👍

   But the only options are ones that require connectivity (SMS, email, push).
   👎

   I have zero interest in making managing my travel ... dependent on whether various networks are up.

   If security people can immediately think of common threat models that make them want to avoid your MFA entirely, due to core aspects of your business offering ... some stakeholders were missing (or overridden) in those meetings.

   #MFA