Azure Data Studio - A SandDance demo (2021-12-6)

Daily Coping Tip

Look for new reasons to be positive about the week ahead.

I also have a thread at SQLServerCentral dealing with coping mechanisms and resources. Feel free to participate.

For many of you out there working in a new way, I'm including a thought of the day on how to cope in this challenging time from The Action for Happiness Coping Calendar. My items will be on my blog, feel free to share yours.

Getting Beyond Passwords

Most of us that work with SQL Server likely use either the Windows authentication or a user name and password when connecting to an instance in SSMS or ADS. It's how we've operated for years, and likely will for some time to come. If you connect to Azure cloud resources, perhaps you use some multi-factor authentication (MFA), but that's a minority of us.

If this article is a picture of the real world, far too few people are using authentication beyond passwords for many services. While plenty are using fingerprints, patterns, or face recognition on a mobile device, that's usually the extent to which they actually go beyond a password. I've actually started to see people using PINs on laptops instead of a password, which feels like a step backward.

Recently I saw someone suggest MFA for SQL Server. I would hope that we would get not only more complex authentication for the platform, perhaps even two-person authentication. but I'm not holding out hope. I think the integration AD is likely to require more steps than most administrators want to take. For now, I expect that any sort of on-premises SQL Server security is going to remain the same. For cloud databases, I do think that we will see other options as they become available.

I personally don't think we'll ever get beyond all passwords. There are just too many situations where someone might not have a smart device they can access. Too many unlinked services and organizations that might not want to authenticate to GitHub, Google, Facebook, or any other large service. I certainly can't see email moving beyond passwords entirely. We might get a login with some other service, but a password will still be a last resort.

While I've gotten comfortable with quite a few different authentication mechanisms on a daily basis, I do think that the entire structure is still complex. While I often authenticate with some sort of MFA, it's a mix of copy/pasting codes or pressing authorize buttons. That's if I actually remember which service I used to authenticate to a particular service.

Ultimately, I find unlocking a safe and copy/pasting passwords to be the simplest method, and I find myself often choosing to create accounts with email and passwords. Easier than me trying to track where I might have used Google v Microsoft for authentication.

Steve Jones - SSC Editor

Join the debate, and respond to today's editorial on the forums