Archive for category: Rohos Logon Key

What’s new in Rohos Logon Key 5.5:

• Fixed QR-code display error for “Setup OTP” and “Setup Smartphone” login methods. Now Rohos is generating local SVG file with QR code image instead of using google API.
• Addd 2FA Key name label option when in “Setup Authentication Key” dialog. Now it is possible to assign a label name to each authentication key to distinguish among multiple keys in addition to serial UID number.
• Tested compatibility with ACS PocketKey FIDO USB token – FIDO® Certified USB Security Key by ACS.
• Fixed error during Google OTP setup, click on Display QR code resulting error 404 due to deprecated google API.
• Other minor bug fixing and improvements

Setup Authentication Key dialog box

Just start typing the new name by clicking on Key Label name in “Setup Authentication Key” dialog.

We continue to work under Rohos Logon Key development and now implemented our customers’ latest feedback and bug reports. A new minor update contains several important improvements.

What’s new in Rohos Logon Key 5.3:

• Improvements for Mifare RFID cards to support quick card swipe in some scenarios.
• Improvements on Azure workstation login via RDP to correctly reuse NLA credentials in some scenarios.
• Improved LDAP queries after LDAP_REFERRAL error code.
• Improved 1FA login possibility by using NLA credential for Remote Desktop access when user account have 2FA methods such as Yubikey, FIDO U2F, which in some cases lead to 2FA enforcement.
• Improvements for Mifare RFID Cards login method to use full-size card UID number.
• Added new option for 2FA bypass control feature – “Notify any successful login (2FA/1FA)” which will create push notification for Rohos Logon Key Android/iOS app in case of any login into your Server.
• Improved Emergency Login mode that now allows to use all possible login methods after a successful Questions/Answers procedure. You need to restart Windows after the Rohos Emergency Login procedure to access all possible credentials methods, such as Face Login, PIN code, etc, for normal login. These changes apply only for console based computer access.
• Improved Rohos Logon Key for Android app, new version 2.17 now has been published on Google Play Market. Added “2FA events list” and “Copy Push URL to clippboard” commands.

Download and Install over the existing Rohos Logon app to try new features:
Download the latest Rohos Logon Key v.5.3 (15-day trial full version) >>
Install Rohos Logon Key app for Android >>

About Rohos Logon Key

Rohos Logon Key adds strong two-factor authentication for Windows login and safeguards to prevent 2FA / MFA bypass attacks. Rohos allows implementing multi-factor authentication decision solution, where you can combine different authentication devices: password, PIN code, Smartphone, or strong authentication devices like U2F key, YubiKey, Google Authenticator One-Time password codes, SafeNet iKey tokens, or RFID cards. With Rohos you can protect standalone computers, Active Directory workstations, Terminal Servers, Azure and AWS workstations, or other remote assistance solutions like TeamViewer, and AnyDesk.

Get your copy of the Rohos Logon Key>

View the list of available 2FA methods in Rohos Logon Key> 

Here we would like to share the items from the product roadmap briefly.

Currently in Rohos Logon Key roadmap list:

• More robust two-factor authentication redundancy support for Windows.
• Integrated two-factor authentication bypass control with push notifications in Rohos Logon mobile app, better detection for various remote tools, and unattended support tools like TeamViewer, AnyDesk, VNC, etc.
• Further development for Rohos logon Key for Android/iOS with improvements and better push 2FA method support.
• Better and smoother OTP self-enrollment, auto-enrollment for OTP in Aactive Directory.
• MS azure support via MS Graph integration.
• webhooks support for 2FA auditing and 3rd party SIEM integration.
• Development of Polymorphic setup file to avoid being detected and disabled in an automated way by malware or possible attackers.  
• Adding subscription licensing type with included SLA support, updates, and Rohos SBOM data. 

We are glad to announce Rohos Logon Key 4.8 with automated prevention over ‘Two-Factor Authentication bypass scenarios’. The new experimental feature allows to get an immediate push notification on the smartphone when the Two-Factor Authentication (2FA / MFA) procedure is avoided during login/unlock or reconnecting to console or remote sessions. Because of well-known system vulnerabilities that allow RDP session hijacking, never-ending stories with 0-day exploits in RDP protocol or authentication system, and unattended remote tools like TeamViewer or 2FA credentials theft during fishing and social engineering – all these lead to unpredictable threat models and risks.
Rohos Logon commits to experimental innovation to address these issues. Currently, Rohos Logon Key app uses three simple rules to trigger push notifications and lock the session in case of Two-Factor Authentication bypass. This allows for defining response and mitigation in case of unknown vulnerabilities of the authentication procedure. The experimental approach works well for standalone Terminal Servers, AD farms, cloud servers in AWS or Azure, workstations, or personal laptops as well. In the future, we plan to add more rules and response actions that allow mitigating authentication vulnerabilities of Windows system, Rohos or human factors. Currently, Rohos Logon Key is the only 2FA application in the world that offers self-control backward loopback, starting from the login prompt to the RDP session desktop. Read more about how it works.