For the logon process (now so important for Activation Manager as well as other things) it would be really nice if:
(1) 2FA including using Authenticator apps was able to “remember” the machine so that you had the option to just use normal user/password on trusted machines (like many other services - even if it just got remembered for a fixed period)
(2) Steinberg started offering support for Passkeys, ideally without the additional 2FA process (as passkeys are themselves two-factor) - with fallback to user/password. Given the account use is often tied to a specific device/machine, this would both give an improved user experience at the same time as increasing security of the accounts (and the option to offer passwordless accounts in the future).
Logon and password works on any machine for me? There’s no “trusted machines”?
In a 2FA login process, you’ll be asked for the authenticator code, and many login systems allow you to mark a device as “trusted” so that you won’t be asked for the code again—at least for a definable period of time.
I don’t have 2FA on any Steinberg apps, is that an option?
There is 2FA for login to the Steinberg Online profile, but unfortunately not for the Apps. This is exactly what is missing.
Ah, I don’t use 2FA for the Steinberg site either…I didn’t know it was an option.
2FA for apps is there - at least anything that is using Steinberg Activation Manager, as the logon for that uses the web to get credentials.
In principle I would support the suggestion, however there is one flaw that I cannot get my head around when it comes to passkeys:- almost all of the implementations I’ve seen are in effect building in a single point of failure in the form of a device of some sort, be it a computer, a phone or a hardware key, and if – in order to avoid being permanently locked out – some fallback to user/password is available, does that not defeat the purpose of the passkey in the first place?
Just moving to using Passkeys instead of username/password removes the phishing attack vector as well as making the logon simpler and faster compared to the normal username > password > 2FA authentication process.
Adding Passkeys to an account still allows user/password as the fallback - it is only a user deciding to move their account to being “passwordless” when the password is removed.
Passkey implementations should (FIDO Alliance guidance and WebAuthn best practices) always allow multiple passkeys across devices - and they can be stored in secure vaults (Apple, Google, Microsoft, Samsung and 3rd party Password Managers) so they can roam between, and sometime across, devices.
The strong recommendation is always to setup more than one passkey across multiple devices to allow for, e.g. loss of phone without the need to go through account recovery.
