6 ms·
Okay, and I don't want to install an app, don't want "Windows Hello" to have my face, don't have a "security key" and don't want to give Microsoft my phone numb
by arsome 5y ago
Okay, and I don't want to install an app, don't want "Windows Hello" to have my face, don't have a "security key" and don't want to give Microsoft my phone number.
All of these options seem to have a damning tendency to compromise your privacy in one way or another.
Passwords remain the best option for privacy, especially when a company refuses to implement TOTP.
- tallanvor 5y agoWindows Hello is basically the same thing as how you unlock your phone with Apple or Android. --Your biometric data doesn't leave your device, instead it's used to unlock a certificate in a TPM. I'm not sure how that's supposed to compromise your privacy.
- Talanes 5y agoThough it can easily fall prey to the same problem as the security key: my machine doesn't have any biometric inputs, so I'm at least back to "buy something."
- Godel_unicode 5y agoPIN, pattern, phone app.
- scoutt 5y agoIf those are three different things, and I can choose one of those, why a four number PIN code would be safer than a password?
- tremon 5y agoMicrosoft's "PIN" is not a four-number digit code, it's an arbitrary-length device passphrase that can include all symbols found on your keyboard. The only reason they don't call it a password is because you already have a (global) account password, and the PIN only serves to unlock that device. If you have two devices, you can have a different PIN for both, that will still log you into the same account.
- tialaramex 5y agoCritically they don't know the PIN and so can't lose it. When you use your global Microsoft account login they know the password. Now, if they're careful they immediately forget it after verifying it, and it's hard to steal the authentication credentials they keep, and so on. But you're relying on them being unfailingly careful there. Whereas, for the PIN even if Microsoft screws up they don't know it and can't lose it. FIDO 2FA is safer because both factors stay where you are, the FIDO device promises it checked the other factor. The FIDO device is something you have, while your other factor (like a PIN, something you know, or a fingerprint, something you are) it vouches for by signing a bitflag labelled UV User Verified. This flag says, I promise I verified this is the same human that we originally enrolled. Which human? Not something the FIDO device knows or cares about and so it can't tell the Relying Party anything they didn't already tell it about who was enrolled. How did it check? Not revealed to the Relying Party.
- EtienneK 5y agoBecause it is tied to a specific device and is not global like a password is.
- watwut 5y ago> Windows Hello is basically the same thing as how you unlock your phone with Apple or Android. People have option to use codes.
- Godel_unicode 5y agoWindows Hello supports PINs and/or patterns in addition to biometrics.
- vladvasiliu 5y agoI'm OK with having a security key, and actually have one (YubiKey). But MS went out of their way to only allow using it under Windows for some reason. If you want to log in to Azure/Office 365 from a different OS, you have to use some other way. > especially when a company refuses to implement TOTP. They do have TOTP, though. It's called "Authenticator app". The one that does the push notification and is MS-only is called "Microsoft authenticator" in their list. This works both on my personal, basic "outlook.com" account and on my work Azure / Office 365 one. --- What I find funny is that for the personal account, the push notification seems better implemented: they send a code that's also on the screen, so you can know that you're approving the action you're currently doing. On the Office 365 subscription, I just get an "approve / cancel" box. This could probably be abused by someone knowing that I'm about to log in, since I have no way of knowing what I'm approving.
- Xylakant 5y ago> But MS went out of their way to only allow using it under Windows for some reason. If you want to log in to Azure/Office 365 from a different OS, you have to use some other way. According to Microsoft’s documentation, windows, macOS and Linux are all supported, but only edge and chrome on macOS and only chrome on Linux. https://docs.microsoft.com/en-us/azure/active-directory/authentication/fido2-compatibility https://docs.microsoft.com/en-us/azure/active-directory/auth... When we implemented this lately, we did find another somewhat annoying speedbump: If you use SAML-based SSO and log in with a yubikey, some SSO breaks since the application at the other end requires explicit password-based authentication. Fixing this requires assistance from the application provider who may be unwilling to fix this.
- vladvasiliu 5y agoInteresting, can confirm Chrome works on Linux. What's weird is that Teams on Linux does show the "sign in with security key" but it doesn't do anything.
- deleted 5y ago[deleted]
- deleted 5y ago[deleted]
- Godel_unicode 5y agoPIN.
- deleted 5y ago[deleted]
- md_ 5y agoThe argument that Microsoft is somehow to blame for wanting you to either give them your phone number or buy a $10 security key before giving you access to their free online email and services is...weird? Like, it's pretty normal for such services to demand phone numbers. Like Signal does. If you don't like it, you can use something else? I fail to see what the big deal is here.
- propertymagnate 5y agoMicrosoft owns the computer industry. "Use something else" is quite a weak argument in markets dominated by oligopolies and especially in this one. At the very most, the argument would be "use the other one". Passwords are broken, now give us your face for facial recognition. Facial recognition is broken, now etc etc
- md_ 5y agoThis is a strange argument, to me. I don't have any devices made by Microsoft, and have not for years. And I'm lazy and disinclined towards "linux on the desktop" neckbeardism. ;)
- propertymagnate 5y agoCongratulations. Microsoft Windows, Microsoft Exchange, Microsoft Word, Microsoft Teams, Microsoft Excel, etc etc.
- Godel_unicode 5y agoMacOS/Chrome os, iCloud/Gmail, Google docs, zoom/whatever Hangouts is called today/discord, Google sheets. It's not even that hard to avoid Microsoft.
- logosmonkey 5y agoIt's difficult in corporations, but not at home.