Falsehoods Security Team Believes About Users.
- Users have a smartphone
- Users are happy to install Microsoft Authenticator on their smartphone
- Users have a 'personal' email address.
- Users have access to a 'personal' email address at all times.
- The user's smartphone is not riddled with malware.
- Users know what an email address is.
- Users believe in and appreciate corporate security efforts.
- Users have a mobile number.
- Users know what their mobile number is.
- Users can receive SMS on their mobile phone.
- Users can distinguish MFA texts from their 10,000 unread spam texts.
- Users have any phone at all.
- If a user doesn't have a phone, they are happy to get one.
- If a user doesn't have any phone at all, they are happy to carry, take care of, and learn how to use a company phone.
- A user knows what a mobile phone is.
- The user who is well into their 60s definitely doesn't share an email address with their retired wife, with which they tackle any and all computing problems together with a loudspeaker phone call to ICT, mostly managed by said wife (who has not signed an NDA) because her hearing is much better.
- Users know what a password is.
- Users are willing to remember a secure password.
- The user definitely isn't reading their password aloud to their wife Marjorie who will likely be called upon to recite it next time it is needed.
- The user knows what a username is.

#security