8 ms·
The problem here is MS's terrible MFA & "SSO" implementations. If I didn't need to MFA multiple times per day into Azure¹ (i.e., if I could sign in truly once p
by deathanatos 5y ago
The problem here is MS's terrible MFA & "SSO" implementations. If I didn't need to MFA multiple times per day into Azure¹ (i.e., if I could sign in truly once per, say, 24 hours), and if MFA was just a literal MFA², the fatigue would not be so incredibly high to begin with. Solutions like a Yubikey Nano are going to seem like future tech to anyone that has to put up with MS Authenticator.
All of the articles suggestions just seem to make more work for the alright overburdened user. Fixing the fatigue at its root is what is needed. (But the article is oddly targeting administrators, for whom such a fix is impossible, not … MS themselves.)
¹different Azure tenants, despite being tied sort of to the same user, require separate MFA/auth sequences. In a separate AAD tenant, my user is technically separate, but also technically not; best I understand it is that it is sort of like a shadow user ("guest", in AAD) to my real user. AAD knows they're connected … but not well enough to matter for MFA.
²MS Auth requires a double PIN entry on the phone in order to respond to an MFA. It used to be you could just tap the notification, but at some point, that got axed, and the fatigue went up like 3x. MFA is supposed to be proof of possession (I have the phone), not proof of knowledge (password, pin). An non-pin-protected notification is fine; the password still covers the "what you know".
- judge2020 5y ago> double PIN entry Are you talking about 'settings->app lock'? This setting assumes you have Touch ID or Face ID set up; either the iOS API prompts for your PIN if you don't have those two, or Microsoft Authenticator falls back to asking for it. https://developer.apple.com/documentation/localauthentication/logging_a_user_into_your_app_with_face_id_or_touch_id#:~:text=the%20device%20passcode.-,Evaluate%20a%20Policy,-When%20you%E2%80%99re%20ready https://developer.apple.com/documentation/localauthenticatio...
- deathanatos 5y agoWell, I'm on Android, so that wouldn't apply, at least not directly. I've never investigated biometrics. I still don't think they're necessary here. Tapping the notification, nowadays, requires unlocking the screen. That's PIN entry #1. Then, MS Authenticator itself requires you to enter your lockscreen PIN, for #2. (Some time ago — months? years? — it used to be you could acknowledge the MFA request from the lock screen.) Edit: OMG it's a setting! I've disabled this nonsense. I swear I looked when it was first introduced, but IDK. MS & defaults. I love Cunningham's Law sometimes, this is going to make MS Auth somewhat less annoying.
- hnburnsy 5y agoTry turning off App Lock in the Ms Auth settings. With this off I can even acknowledge requests from my Garmin watch. It will disable the ability for Ms Auth is auto fill passwords in Android at least.
- sebazzz 5y ago> Solutions like a Yubikey Nano are going to seem like future tech to anyone that has to put up with MS Authenticator. Except Microsoft requires you to protect your Yubikey with a pin-code (even the consumer accounts), instantly making it unusable for your iOS device if you use it via NFC.
- nightski 5y agoThe funny thing is on Windows once you set up your Yubikey in Windows Hello it doesn't even matter. You are still forced to use the PIN and at that point why bother with the key. I'd much rather skip the pin and just use Yubikey lol.
- blakes 5y agoSounds to me that MFA is not setup correctly for you or the Azure tenants you are logging into.
- bastardoperator 5y agoSame, I get a request from the authenticator app, login in via facetime and click a dialog that asks me to authorize (yes/no). I don't love it, but it's pretty simple.
- kiwijamo 5y agoWhat the parent describes is exactly how it works for my employer's O365 system. I get MFA requests on a regular basis even on known devices. Ticking the 'dont ask again' option has no effect. Meanwhile Google on the same devices nags me once a week at the most.
- blakes 5y agoI have a lot of experience managing O365/Azure, and these issues all come down to the config of MFA in the O365/Azure tenant. They may even be intentional for "security" purposes. To be fair, O365 and Azure change all the time. I've seen these issues on neglected O365 tenants, usually MFA was setup years ago and never touched again.
- ska 5y agoThis seems to be super path dependent. I've seen google devices nag daily, and O365 stay logged in for weeks/months. Too few measurements to have a strong opinion on which scenario is more likely, but it does seem interesting that a number of configuration or other issues seem to be solved by : just aske for auth again.
- silisili 5y agoDo we work at the same company or is O365 that bad? We just had a big discussion on Slack as to what that checkbox actually does, because it's apparently nothing...
- davorak 5y ago
- teeray 5y agoIt’s irritating that the “something you have” for most things can’t be “a laptop with a TPM.” It’s functionally equivalent to phone-based MFA. The only improvement would be some screen + touch approval (like the touchbar had for privilege elevation). That would at least leave a human in the MFA loop in the event of machine compromise.
- jsnell 5y agoNot quite equivalent. When an attacker compromises your laptop, they'll get all of the factors in one go: steal all your bearer tokens, steal your password with a key logger, and operate the TPM remotely.
- alisonkisk 5y ago
- vorpalhex 5y agoThey would have to break your hard drive encryption AND have the laptop itself. Doable by a nation state? Sure. By Bob the mugger? No. That is fine for 98% of users.
- tdeck 5y agoI think the parent comment was referring to a scenario where the attacker has code executing on your laptop, not necessarily a physical seizure of the device.
- vorpalhex 5y agoThat would mean the parent does not understand how a TPM operates. Several other commentors have provided good explanations to correct that fault.
- raxxorrax 5y agoNot really sure of the capabilities of nation states. They buy the tools private companies come up with. But I think this is exaggerated security anyway. You want to keep stuff accessible. Binding anything to specific hardware is a terrible idea. My bank does that and it really sucks as a security mechanism.
- lima 5y agoYep. Azure is just awful. With Google SSO, I log in and do MFA once per year or so on trusted devices and any further prompt beyond that would be extremely suspicious. With Azure, I have to complete the sequence like a hundred times per day.
- trevorishere 5y agoIt's not Azure, it is how your organization decides to implement MFA. The only time re-MFA'ing is 'required' is when your password expires (if it does) as your token expires. Otherwise, you could have 365 day token lifetimes if your organization configured it. Or greater.
- tapland 5y agoI've never heard of anyone with azure properly set up then. In two orgs I've had the exact described behavior. Even for a school that uses azure =(
- brazzledazzle 5y agoMicrosoft gives well meaning but overzealous security teams too many knobs. It’s one of the reasons they can check off so many security checkboxes.
- aiisjustanif 5y agoFriendly reminder to revoke your sessions when resetting compromised users. :)
- TuringNYC 5y agoForget Azure. Even Outlook/Teams flips apps between Teams/MSAuthenticator over and over. My iPhone goes into strange loops. Sometimes, its logged-out but doesnt show it and just doesnt update anything. Its nuts how vast the chasm is between Azure/Outlook/Teams vs AWS/Google.
- bogwog 5y ago
- jokethrowaway 5y agoAll European / UK banks I've tried are just as bad as azure as of lately. Thanks SCA, I guess. What's the purpose of authenticating me 8 times in the span on 10m. Open banking api that allow you to add accounts from other banks were promising but they turned out to be half baked versions, so in practice I still have n bank apps ok my phone. Not to mention I could not do online banking without my phone. I've been seriously considering automating all of that and just have an application with a master password which access encrypted multiple banks secrets and authenticate / perform local mfa as required and let me have the banking experience (for a single bank) of, say, 10 years ago. All of this for what? If someone hacks my account and steal my money I hope the bank mafia would be able to sort out things with the target bank and hallucinate a balance without the theft (especially because they flag tons of payments as fraudulent, requiring me to call them).
- deadbunny 5y agoYou might be interested in teller.io
- sofixa 5y ago> All European / UK banks I've tried are just as bad as azure as of lately. How so? I have like 6 different banks ( some"legacy", some fancy "app-only"), and for all of them friction is minimal for the security. All apps work with biometrics/code, and all websites ( where available) don't ask for MFA on known devices. Web payments always require MFA with the app as per the recent regulations.
- amoshi 5y ago>It used to be you could just tap the notification, but at some point, that got axed, and the fatigue went up like 3x. Must be your tenant settings or something, my phone just gets a single Allow/Disallow notification that takes a fraction of a second to tap. Surprisingly though, I can tap it from the lockscreen too, without unlocking the phone.
- jeromegv 5y agoYou could disable this setting on iOS to force unlock to see the notifications.
- hnburnsy 5y ago>²MS Auth requires a double PIN entry on the phone in order to respond to an MFA. Check Settings: App Lock.
- jimbobimbo 5y agoWhile I agree that there could be a lot of authentication prompts to deal with, keep in mind that the frequency and kind of notifications you get depends on security requirements of the operation/flow you're in and are not indicative of the "quality of SSO implementation". Some high-security flows use auth tokens with short TTLs (e.g., 20 mins). Some flows may trigger "less secure" "pick a number" notification (user is prompted to tap 1 number out of 3); some flows trigger "enter a number" notification, when user has to enter the number they see on the login prompt (I personally hate this one). Some of these things are controlled only by service (e.g., TTL of the auth token), some I suspect could be tweaked by the tenant admin (e.g. pick vs. enter a number).
- kbenson 5y agoI assume a lot of this is org controlled and has toggles to allow or disallow certain things, because for our AD environment when they started recommending Windows Authenticator for MFA the first thing I did was test that it works if I just add it to Google Authenticator like my other MFA things, and it did, and I've been using it that way for about two years now I think.
- PascLeRasc 5y agoThese things shouldn't be set by an organization. Microsoft needs to actually advocate for its users and stop creating options that make their products work shittier.
- mngnt 5y agoI disagree. Many times, the org settings make a users life so much easier. We use MS SAML SSO for all our tools (office, Outlook Web, Atlassian toolstack, another ticketing tool) and I really only need to use the 2nd factor once in a few days or when I log out manually, and it's a simple sms code. Reading other comments here, my life is SO easy in this regard. I actually considera Microsoft single login with (sms) 2FA a good thing and therefore have almost 0 "mfa fatigue".
- tablespoon 5y ago> "SSO" implementations I love SSO. It means every time I log in, I get to do it twice! I'm looking at you, GitHub.
- weq 5y agoomg the experience sucks
- raxxorrax 5y agoWe have reduced MFA again and use very strong passwords and good password managers protected by yubikeys instead. Many APIs are still accessible without MFA that could lead to data exfiltration anyway. The workaround for that to register privileged applications is not really too convincing and just not flexible enough.