5 ms·
Microsoft decides it will be the one to choose which secure login method you use
- wodenokoto 3y agoI don’t get it. What do you do if preferred method is genuinely not available to the user?
- mschild 3y ago> If they can't use the method they were prompted to use, they can choose a different MFA method to sign in Let you use a different method you signed up for.
- pc86 3y agoMy guess is that it's in the second sentence of the article :)
- reportgunner 3y agoSounds like you can just click through to the least secure option.
- angry_octet 3y agoPresumably this allows them to change the confidence statistics for logins, so that, e.g., SMS 2F is considered more likely to be an attacker. SMS 2F from a different location to a previous certificate/FIDO2 login might be denied or alerted. Also, they’re trying to force people into using the Microsoft Authenticator, which is an active telemetry collector, vs e.g. Google Authenticator, which is 100% offline and TOTP only.
- mschild 3y agoHeadline is certainly attention grabbing but not as bad as it sounds. This is, currently, for commercial customers only and will always pick the most secure option that your account has setup. If the most secure option is not available, they'll go the next one. This generally makes sense. Obviously, I'd prefer if you can pick and choose the order, but then again it's Microsoft so I'm not surprised whatsoever.
- xg15 3y agoWhat I don't get, what would stop an attacker from also saying an option is not available, until they arrive at a weak enough option to crack?
- vel0city 3y agoTrusted platform related protections?
- tapoxi 3y agoI mean it's the Register, they're a tabloid. Their articles are interesting sometimes but I'm just exhausted by the tone at this point.
- phpisthebest 3y agoI trust the Register most then most "news" outlets
- brookst 3y agoSo edge!
- JohnFen 3y agoThe Register tends to do good reporting. They absolutely have a mocking and disrespectful tone to them, and love an inflammatory headline, but that's just style.
- brookst 3y agoIt's The Register. Sometimes good info, but they pride themselves on having the editorial tone of 4channers hopped up on meth.
- sirmoveon 3y agoVery convenient to force biometrics tied to user profiles... when you have centralized control of the system and delve in occasional data collection.
- withinboredom 3y agoIsn't biometrics only on-device?
- causi 3y agoCan't Microsoft change the answer to that question whenever they please?
- vladvasiliu 3y agoIt's "only on-device" as in the data isn't sent to MS servers (in theory). According to ms's docs, depending on the sensor implementation, the OS might have access to that data: https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-biometrics-in-enterprise https://learn.microsoft.com/en-us/windows/security/identity-... > Some fingerprint sensors have the capability to complete matching on the fingerprint sensor module instead of in the OS. These sensors will store biometric data on the fingerprint module instead of in the database file. So, knowing how most "enterprise" pcs get the cheapest possible implementation, I'd bet that in most cases windows stores the biometric data itself.
- withinboredom 3y ago> I'd bet that in most cases windows stores the biometric data itself. I suspect it is more likely the driver and Windows has no real visibility into it.
- Brendinooo 3y agoGoogle has done something similar; they make it hard to use my preferred 2FA app ("Authenticator" for iPhone). In order to add it I had to pick a different thing, then add 2FA, then remove the other thing. And even with that, it still tries to get me to authenticate with one of their apps on one of my iThings, de-emphasizing the option to just put in my code. Dunno why these companies are like this, is there a good-faith explanation? Maybe they have a lot of support problems with authenticator apps?
- nikanj 3y agoGetting your app on more phones means more access to data. Not sure if that explanation is good-faith, but that’s the explanation. Same reason all sorts of websites try to force their apps on you
- Maxburn 3y agoI can't help but think this is the excuse, anything for another foot in the door to further their adoption.
- scq 3y agoThe most likely reason is that TOTP is not phishing resistant.
- tallanvor 3y agoBecause 3rd party 2FA apps are inherently untrustworthy. To Google, even Microsoft Authenticator is a security risk because to use it you have to give it the TOTP seed for your account. So Google (and Microsoft) would rather you use their solutions that let them push the prompt to you and ensure that it's a known device responding. It's still not a perfect solution, but it still is a more secure option.
- vinay_ys 3y agoGoogle doesn't trust its own authenticator app as well for high-security situations.
- vondur 3y agoYes, I’ve been forced to use passwordless login for a couple of weeks at this point.
- TowerTall 3y agoI have that enabled too. Now I can no longer RDP into my computers or connect to fileshares as those do not support passwordless accounts. It been like that for years, since MS introduced first passwordless Microsoft Accounts.