3 ms·

As with most (all?) Android apps, support for permission requires user consent; Camera, "Files and media" and Location are all set to "Not allowed" on my device

As with most (all?) Android apps, support for permission requires user consent; Camera, "Files and media" and Location are all set to "Not allowed" on my device. From what I can tell based on Microsoft's help page, location may be a requirement of a work/school account and as far as I can remember, I've never been prompted for the location permission - it's possible I denied access if I was, but the app works without it. From Microsoft's Authenticator help page: "You will see a prompt from Microsoft Authenticator asking for access to your location if your IT admin has created a policy requiring you to share your GPS location before you are allowed to access specific resources" https://support.microsoft.com/en-us/account-billing/common-questions-about-the-microsoft-authenticator-app-12d283d1-bcef-4875-9ae5-ac360e2945dd https://support.microsoft.com/en-us/account-billing/common-q...

angry_octet 4y ago
There's one big data leak which Android/iOS deliberately don't let you control: internet access. TOTP apps don't need it, and yet. The Microsoft app does have a mode which uses the internet to push a message saying "Is this you logging in?", which is weaker than TOTP but feeds into their "AI threat detection engine" mantra. It seems to fall back to TOTP if there is no network.
autoexec 4y ago
The problem with android is that it's designed to leak your data like a sieve, so permissions are overbroad and all or nothing. Most people will accept any and every prompt for a permission they're told is required in order to use the app, even when the app doesn't always need it to function. MS is clearly using this to their advantage and asking for everything they can provide even a thin justification for, but even if you're just giving them a fraction of what they're asking for it's still far worse than handing over a cell phone number. My work considered requiring Microsoft Authenticator but after enough people balked at handing over so much data to MS they caved and we got simple little keychains that do nothing but spit out numbers and can't collect our contacts, our location, or start listening using a microphone. It's hard to beat that.

angry_octet 4y ago

There's one big data leak which Android/iOS deliberately don't let you control: internet access. TOTP apps don't need it, and yet. The Microsoft app does have a mode which uses the internet to push a message saying "Is this you logging in?", which is weaker than TOTP but feeds into their "AI threat detection engine" mantra. It seems to fall back to TOTP if there is no network.

autoexec 4y ago

The problem with android is that it's designed to leak your data like a sieve, so permissions are overbroad and all or nothing. Most people will accept any and every prompt for a permission they're told is required in order to use the app, even when the app doesn't always need it to function. MS is clearly using this to their advantage and asking for everything they can provide even a thin justification for, but even if you're just giving them a fraction of what they're asking for it's still far worse than handing over a cell phone number. My work considered requiring Microsoft Authenticator but after enough people balked at handing over so much data to MS they caved and we got simple little keychains that do nothing but spit out numbers and can't collect our contacts, our location, or start listening using a microphone. It's hard to beat that.