How to implement 2FA without relying on mobile phones

How to implement 2FA without relying on phones Addressing employee concerns over personal device use for authentication

Cybersecurity specialists working in enterprise environments are well aware of the importance of strong authentication methods like FIDO and passkeys. These technologies offer strong, phishing-resistant security and promise a future without password vulnerabilities. One major obstacle that often comes up when we talk to our clients is employee reluctance and company policies that prevent the use of personal devices for work-related authentication. For many organizations, the challenge is not just finding the right tools but implementing them in ways that respect employee boundaries and adhere to company policies.

This article addresses these specific barriers, exploring mobile-free 2FA and passwordless solutions that organizations can adopt without relying on employees’ personal phones. Here, we’ll outline strategies that meet the highest security standards while accommodating user preferences and privacy.

How to Implement Passwordless Logins with Passkeys A Secfense Guide

The limits of mobile-based 2FA in the enterprise

In many workplaces, 2FA typically involves sending a verification code to an employee’s personal phone, either via SMS or a mobile authenticator app. But this method comes with distinct drawbacks:

  • Privacy concerns: Employees may be unwilling to use their personal devices for work-related 2FA, citing privacy and boundary concerns.
  • Device compatibility: Employees may have different mobile devices, complicating management and creating compatibility challenges.
  • Security: IT teams often can’t control personal devices, making it hard to ensure that these devices meet enterprise security standards.

Given these limitations, many organizations may choose mobile-free 2FA solutions that are more likely to gain user acceptance.

Mobile-free 2FA solutions for the modern enterprise

For organizations aiming to implement mobile-free 2FA that also meets strong security standards, here are several effective alternatives:

1. Hardware security keys (FIDO2 compliant)

  • Description: Hardware security keys like YubiKeys are physical devices that plug into a computer’s USB port or connect via NFC. These keys support FIDO2 standards and allow secure, passwordless authentication.
  • Benefits: Hardware security keys are phishing-resistant, highly secure, and don’t require users’ personal devices.
  • Challenges: To implement at scale, companies need to manage lost, damaged, or forgotten physical keys. Backup access methods, such as bypass codes or secondary keys, can help reduce the impact of lost keys and prevent access disruptions.
Securing VPN: Protecting Corporate Data from Cyberattacks with Secfense 02

2. Desktop-based software authenticators

  • Description: Desktop authentication software enables 2FA directly on the user’s computer, typically using time-based one-time passwords (TOTP) or push-based authentication. These software authenticators eliminate the need for mobile devices entirely and can be managed centrally, allowing IT to control updates and configurations.
  • Benefits: Desktop software authenticators are device-independent and can be managed centrally by IT.
  • Challenges: TOTP-based solutions are vulnerable to modern phishing attacks, where hackers can intercept codes or tokens in real time. In contrast, FIDO2-based authentication is phishing-resistant and offers higher security by binding the authentication to the specific device and relying on cryptographic keys. Additionally, desktop solutions require workstation security measures to prevent unauthorized access if a desktop is compromised.

3. Windows Hello for Business (for Windows-centric organizations)

  • Description: Windows Hello for Business provides a passwordless login option on Windows 10 or later, using a PIN to authenticate users without the need for biometrics. The system stores authentication information in the device’s Trusted Platform Module (TPM), ensuring strong security.
  • Benefits: Windows Hello integrates seamlessly with Azure AD, supports FIDO2 standards, and doesn’t require mobile devices. This option is highly user-friendly for Windows-based organizations.
  • Challenges: This approach works best in Windows-centric environments and requires IT to set and manage PIN policies for consistent application across all users.

Addressing common challenges in mobile-free 2FA implementation

Gaining user buy-in

Cybersecurity teams that want to reduce employee resistance against MFA should emphasize the benefits of mobile-free 2FA for both privacy and security. Clear communication helps employees understand that these methods enhance security without involving personal devices. Training sessions that show how these methods protect both the organization and individual privacy can improve adoption rates.

Handling lost or damaged hardware

Establishing a good management system is essential when deploying hardware-based 2FA at scale. Policies should include a clear process for issuing replacement keys or cards to provide temporary access in case of lost devices. These protocols reduce security disruptions and ensure that users can maintain access when hardware is lost or damaged.

Ensuring system compatibility

Compatibility is essential to successfully deploying mobile-free 2FA in enterprise environments. Solutions like the Secfense User Access Security Broker enable seamless integration of FIDO2 and passwordless authentication across existing applications without changing the code. This means that organizations can adopt new authentication methods across legacy systems and SaaS applications with minimal operational impact.

Strong MFA without mobile phones  - Connect with a Secfense specialist to find the right solution for your team’s needs

Key takeaways

  • Privacy and security: Mobile-free 2FA options, such as hardware keys and smart cards, offer robust protection while respecting employee privacy and preferences.
  • Centralized management: Using a centralized management system for hardware-based authentication enables tracking and streamlining of key issuance and recovery processes, especially important in larger organizations.
  • Employee training and education: Providing users with clear information on the benefits and use of new methods helps foster a smoother transition and ensures a higher rate of user acceptance.

Conclusion

Secfense strongly advocates for FIDO2 as the most secure, phishing-resistant standard in authentication. Ideally, organizations should educate employees on the advantages of using FIDO2-based passkeys and, where possible, encourage the use of personal devices for work authentication as part of a secure, modern approach. However, for those who cannot or prefer not to use mobile phones, options like FIDO2-compliant hardware keys, desktop authenticators, and smart cards provide scalable alternatives that meet high-security standards without relying on personal devices. By adopting these solutions, organizations can create a user-friendly 2FA environment that respects employee preferences while enhancing security.Curious about mobile-free 2FA options for your organization? Contact a Secfense specialist to explore secure, scalable solutions tailored to your needs, or download our free eBook to learn more about passwordless authentication and the future of secure access.

Antoni takes care of all the marketing content that comes from Secfense. Read More

Testimonials

We are faced with new challenges every day. We must always be one step ahead of the attackers and know what they are going to do before they do it. We are convinced that the User Access Security Broker will bring security to a new level, both for those working at the office and from home. For us, working with Secfense is an opportunity to exchange experience with developers who put great value on out-of-the-box thinking.

Krzysztof Słotwiński

Business Continuity and Computer Security Officer

BNP Paribas Bank Poland

As part of the pre-implementation analysis, we verified that users utilize a wide range of client platforms: desktop computers, laptops, tablets, smartphones, and traditional mobile phones. Each of these devices differs in technological advancement, features, and level of security. Because of this, and also due to the recommendation of the Polish Financial Supervision Authority (UKNF), we decided to introduce additional protection in the form of multi-factor authentication mechanisms based on FIDO. As a result, users of our applications can log in safely, avoiding common cyber threats such as phishing, account takeover, and theft of their own and their clients’ data.

Marcin Bobruk

CEO

Sandis

We are excited to partner with Secfense to enhance our user access security for our web apps. By integrating their User Access Security Broker, we ensure seamless and secure protection for our applications and systems, delivering superior security and convenience to our customers.

Charm Abeywardana

IT & Infrastructure

Visium Networks

Before investing in Secfense, we had the opportunity to talk to its existing clients. Their reactions were unanimous: wow, it’s so easy to use. We were particularly impressed by the fact that implementing their solution does not require the involvement of IT developers. It gives Secfense a huge advantage over the competition, and at the same time opens the door to potential customers who so far were afraid of changes related to the implementation of multi-factor authentication solutions.

Mateusz Bodio

Managing Director

RKKVC

Even when the network and infrastructure are secured enough, social engineering and passwords can be used to gain control of the system by attackers. Multifactor authentication is the current trend. Secfense addresses this and allows you to build zero trust security and upgrade your current systems to passwordless applications within minutes, solving this problem right away,” said Eduard Kučera, Partner at Presto Ventures and cybersecurity expert – former Director in hugely successful Czech multinational cyber security firm Avast.

Eduard Kučera

Partner

Presto Ventures

One of the biggest challenges the world is facing today is securing our identity online. That’s why we were so keen to have Secfense in our portfolio. They make it possible to introduce strong authentication in an automated way. Until now, organizations had to selectively protect applications because the deployment of new technology was very hard, or even impossible. With Secfense, the implementation of multi-factor authentication is no longer a problem, and all organizations can use the highest standards of authentication security.

Stanislav Ivanov

Founding Partner

Tera Ventures

Two-factor authentication is known to be one of the best ways to protect against phishing; however, its implementation has always been difficult. Secfense helped us solve that problem. With their security broker, we were able to introduce various 2FA methods on our web applications at once.

Dariusz Pitala

Head of IT

MPEC S.A.