26 ms·

Flaw has Microsoft Authenticator overwriting MFA accounts, locking users out

497 points by miles 2y ago

RcouF1uZ4gsC 2y ago
Incidentally, this is why SMS MFA is so popular with users despite its security vulnerabilities. Generally, unless you are targeted by someone with a sim swap, it is good enough. Most people won't be targeted, but do have a good chance of something going wrong that makes them lose their MFA key.
- SoftTalker 2y ago
  Yep. It's simple, and almost everyone understands it. Like passwords themselves. Also the reason more secure approaches such as YubiKeys have never taken off in the general public -- they are just cumbersome and confusing.
  - leftbehind 2y ago
    We haven't had any issue getting all of our staff -- nontechnical users alike -- on yubikeys. As part of education we skip the PKI portion and just point out that it is "like your physical house key. You plug it in and touch it to turn the key to unlock"
    - SoftTalker 2y ago
      Yes, and our staff uses ssh keys (generally but not always without issue) and a commercial MFA app. It's one thing to get this stuff used in a controlled environemnt where you have a help desk or administrators who can do a lot of the setup. You just hand the employee their YubiKey or smart card and say "use this." Trying to imagine your grandmother setting it up herself to be able to log in to her Facebook is another matter, and why these things have never worked for the general public.
    - close04 2y ago
      You probably use certificates and a company PKI to manage them. No need to stress if one is lost or locked, just revoke and whip up a new certificate. At home Yubikey is probably synonymous to FIDO not PIV/PKI. No whipping up a new one if you lose it. You better have 3 of them enrolled at any time, and have at least one stored off site.
      - leftbehind 2y ago
        We enroll them as standard fido/webauthn - I hate the other modes. I agree it requires significantly more work when you can't just call the locksmith for a new one -- IT -- if you lose one on your personal account you can only go get the spare key hidden under the doormat, a printed code in your safe, or lose the account.
    - Groxx 2y ago
      For business use, handing out yubikeys is completely reasonable - if they're lost or broken, the company is the authority and they can (and do) just re-issue a new one and work goes on with only a temporary interruption. They're easy to explain, fast to use, provide practical security, and are simple to recover in case of total failure. For personal use, that equation is wildly different. Google isn't going to let you attach a brand new key, you've just lost your account forever because it rained.
  - JackSlateur 2y ago
    Most importantly: yubikeys must be bought
    - alistairSH 2y ago
      And carried around.
- peanut-walrus 2y ago
  Honestly, the only way I see forward is FIDO with dirt cheap NFC cards as keys. Need to log in to somewhere? Get the card from your wallet and touch it to your phone/laptop. It has to be cheap enough that for any company with paying customers it makes more sense to physically mail them a card if they don't already have one than to support any alternative auth methods. Most services won't even need a second layer of auth, if someone steals your wallet - do they really care about your reddit account?
- immibis 2y ago
  I've tried enabling it two times. The first time my phone permanently broke immediately after enabling it. The second time it was stolen. Now I just rely on randomly generated passwords.
SoftTalker 2y ago
"This is a small example of a big problem with usability and cybersecurity. This is what happens when apps are developed by engineers who don’t have a strong knowledge of customers" This really rings true. Just think of all the nonsense you have to deal with in the name of "security." Mandatory password change intervals. Insane rules for constructing passwords. Completely undocumented password requirements that you just have to figure out by trial and error. Complicated error messages full of security jargon. "Secret Questions" that you can't remember the answers to. And on the other side of the coin, the security of these systems themselves is like a sieve. So many data breaches, information disclosures, they are in the news almost daily. I often wonder how they get away with it all.
- robertlagrant 2y ago
  This isn't engineers doing that. It's CYA IT cyber policies.
  - SahAssar 2y ago
    Sure, but a lot of engineers aren't completely blameless. They should push back and explain why these are bad choices just like I would expect a building engineer to say to me that cardboard is not the ideal load bearing element for my skyscraper. If the company still pushes forward with bad choices its on them, but they should be clearly informed how and why those choices are bad.
    - harimau777 2y ago
      Pushing back is a great way to lose your job or get past over for pay raises.
      - SahAssar 2y ago
        In bad orgs, yes. In good orgs you get appreciated for speaking up and communicating what will be future problems.
worble 2y ago
This boggles my brain on so many levels - are you telling me Microsoft Authenticator only stores the entry based on label? It doesn't generate an internal key or anything? And then they claim that the issue is websites not putting the issuer in the label, but in the issuer field, where it belongs? Is no-one at Microsoft actually using their own Authenticator? Unless I'm missing something, this would make it nearly unusable for almost all applications - as soon as you've used your email for one site you wouldn't be able to add it for any others?
- SoftTalker 2y ago
  From the article: "Microsoft hasn’t bothered to fix it because Microsoft Authenticator is a free product and therefore doesn’t generate revenue."
  - deleted 2y ago
    [deleted]
  - lostlogin 2y ago
    It’s actually worse than that. Given the opportunity to escape, I’m sure many would pay to to allowed to do so. Entering multi factor hell just to get into Teams is something I’d happily pay to avoid.
    - tialaramex 2y ago
      Assuming you use Microsoft Entra ("Azure Active Directory" as was), get your employer to enable the "preview" support for Security Keys. Why is it off by default? Well it's actually secure, and it would never do to provide a feature out of the box that actually works without lots of fiddling about, this is Microsoft, the consultant's friend. These seem to be relatively current instructions: https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-enable-passkey-fido2 https://learn.microsoft.com/en-us/entra/identity/authenticat... Having found a friendly sysadmin to do this, ask them to specifically not "Enforce key restrictions" which is theory could let your empoloyer require employees to use a specific issued authenticator credential - are they going to buy every employee an authenticator from a named brand? No? Then this must not be switched on, easy. Once this feature is enabled for you (you may be able to get them to switch it on for the whole org, or maybe for IT or whatever department you work in) you should be able to enrol a new Security Key the same way you'd add other MFA. So why go to all this bother? Because you can buy a Security Key that works how you want, a physical piece of hardware you own and can re-use - if you buy say the Yubico Security Key 2 in USB A, that goes in your USB A port on the laptop or dock and it just stays there. Its job is to be "Something you have" and the "Something you know" will be a PIN of your choosing (it literally doesn't leave your device, so corporate can't decide it should be the Password Game on steroids) No need for a phone or other unrelated device, no opening fiddly apps, no transcribing codes, you type your PIN and touch the sensor. If a PIN is too much, some pricier options take fingerprints, so then you just touch the sensor (with the correct finger)
magicalhippo 2y ago
I've been using Microsoft's one for my work accounts because, well, we're elbow deep into Office365 so why not. I've never gotten that dialog, and have not had any issues with the accounts I've added. Since they're my work accounts, 99% of them share my work email as account name. So does that mean I've just been lucky, in that the sites I've signed with have provided a sufficiently unique label? I feel I didn't fully get what the issue is.
- muststopmyths 2y ago
  Same. 3 personal accounts use the same email address. Two of them are FAANG and it all seems to fine (for going on a decade)
- prng2021 2y ago
  Seems like the bug is specific to the iOS app when scanning QR codes.
  - magicalhippo 2y ago
    Ah, using Android so I guess that's why. Weird though, given that Microsoft claims it's an intentional feature. Why wouldn't a feature like that be implemented in both platforms? Even though it might be a dumb feature as seen from the users POV, it seems sufficiently special that it's something that I would assume one would want to have feature parity on.
    - mattmaroon 2y ago
      I’ve been using MS Authenticator for a long time, mainly on iOS and I’ve never experienced this bug.
  - trustinmenowpls 2y ago
    That's me (iOS scan the QR code) and I've never encountered the bug either.
- mihaaly 2y ago
breadwinner 2y ago
This happened to me when I updated MS Authenticator after not updating it for a while. It wiped out all data, and I got locked out of all accounts. MS Authenticator is not a carefully written product.
napsterbr 2y ago
Something similar happened to me about a year ago when the Google Authenticator app automatically updated to a new version. I lost all my accounts in the update process. Definitely learned a few lessons there.
- xandrius 2y ago
  This nightmare is why I always backup MFA QR codes and use those to add them to an open source app which let's me backup the data elsewhere too. Sorry to hear that!
  - SoftTalker 2y ago
    Yep, any time I use an authenticator with an account I generate "backup codes" and keep them in my password manager. This saved me when I got a new phone and for some reason my Google Authenticator did not transfer to the new phone properly.
    - lostlogin 2y ago
      > Google Authenticator did not transfer to the new phone properly. This seems to be my normal experience with a new phone for MFA apps. I’m doing something wrong. That and setting up email are so dreaded that I hold off updating.
      - knallfrosch 2y ago
        Switching from Android to iOS for a phone, I found that Microsoft Authenticator officially doesn't support this. You can't backup, you can't transfer. Everything is lost, please start anew.
    - mook 2y ago
      I think they finally managed that last year, but only by syncing to your Google account: https://security.googleblog.com/2023/04/google-authenticator-now-supports.html https://security.googleblog.com/2023/04/google-authenticator... … Yeah I'm not sure that's very good for a 2FA app either. Offline backups feel better for me. I use something else for 2FA.
issafram 2y ago
ymmv, but I've never had this issue.
chaz6 2y ago
When asked to set up TOTP, the first thing I do is scan the QR code with a QR code reader, and save the secret into my password manager, before adding it to my authenticator app.
- gleenn 2y ago
  Does this actually work? I thought most TOTP codes were single use. Have you actually tried re-using them?
  - Rychard 2y ago
    The initial QR code isn't a TOTP code, it contains the secret used to generate the TOTP codes.
  - userbinator 2y ago
    The QR code contains the TOTP key, which is the seed that's used to generate the codes, which form a time-based pseudorandom sequence.
  - smitelli 2y ago
    You can absolutely scan the QR code with multiple authenticator apps (or copy paste the seed value into them) and they will all produce the same codes in the same order going forward.
- sleepycatgirl 2y ago
  Oh, that's actually really nice, I should start doing the same thing myself
- esafak 2y ago
  1password lets you see it after you've saved it too.
  - n8henrie 2y ago
    As does Bitwarden (just "edit" and it is revealed)
NotACracker 2y ago
I've just made a test: multiple accounts using the same account/email and there is no conflict. I even have a matching icon of the issuer for each entry; the issuer is registered for each entry. I am using the MS Authenticator for years and I've never had any problem of that sort, and of course, I am always using the same email as my account/username. Anyway, I'm just putting the result of my test. It's not like this going to change your mind about the authenticator or Microsoft itself here...
- 3np 2y ago
  Which platform? Supposedly the issue ("feature") is specific to the iOS version?
  - NotACracker 2y ago
    Android
  - deleted 2y ago
    [deleted]
CatWChainsaw 2y ago
A whole different type of "too big to fail", and a great demonstration of why putting the keys to your kingdom in Microsoft's/Google's/Apple's hands is a stupid idea.
- halfcat 2y ago
  Is AWS any better, or what’s the solution? Most businesses aren’t technical and don’t need to be in the authentication/security business.
  - CatWChainsaw 2y ago
    Greetings fellow feline, I am a microbiologist not IT. In that capacity, the only general suggestion is to have redundant authentication measures that cannot all be crippled by one source like this. I can't imagine it's popular, or easy, for a company to want to be able to use multiple authentication schemes, but this sort of situation shows why lock-in is a bad idea.
ReptileMan 2y ago
And keepass keeps complete history since the file was created. Someone was really sloppy in Microsoft in the design phase.
motohagiography 2y ago
some security products seem like they are designed to discredit security as a field. imo the market is just at the point of backlash against the decadent stupidity in that cost centre. if you are going to humiliate people by making them jump through hoops 10x a day with context switching 2FA tokens and make serious people with educations and responsibilities use words like "smishing," you better be sure that hoop is the finest example of engineering anywhere. the solution has become the problem. I'm calling the peak.
jokethrowaway 2y ago
Are we again in a Microsoft 2000 phase? It seems like everything Microsoft is broken these days. GitHub barely works after the acquisition. Azure is a joke. Teams is the bane of my existance. Outlook is the second one. Do they need to ask harder leetcoding problems during the interviews?
- FridgeSeal 2y ago
  Are they actually capable of releasing anything good? I guess C# isn’t horrible? It’s far from a language I want to use, but it’s not teams level of atrocious, so they’ve got that going for them I guess. VSCode is pretty good, but not good enough to stop me migrating off the second a more viable editor arrived. Word and office have degraded into a “doesn’t aggressively fail” sort of scenario, so they’re not “good” they’re just incumbent.
  - elmo2you 2y ago
    > VSCode is pretty good, but not good enough to stop me migrating off the second a more viable editor arrived. If you're interested, there is VSCodium (VCCode without the Microsoft/proprietary parts). There's also Theia, if you want to take things a step further away from Microsoft. > I guess C# isn’t horrible? It’s far from a language I want to use, but it’s not teams level of atrocious, so they’ve got that going for them I guess. No clue if this is true for other companies, but I know a company that does big outsourcing project and most of them in C#/.NET and Angular. I've seen plenty of that code. My impression was/is that most of the C# code was extremely basic and mostly just tying together all ready-made libraries/features/frameworks/services (which Microsoft provides on their platforms/products) that actually made up the apps/services. C# itself just isn't all that much. Apart from maybe a gateway to guaranteed vendor lock-in. Maybe that is why they made sure to not mess that one up ;)
- resource_waste 2y ago
  Microsoft is a legacy company and soon to be zombie company. I think you'd be out of your mind to start a new company and use Microsoft for anything except Excel. The only reason my company seems to use it, we have software from the 2000s that only runs on Windows. Maybe there is some backdoor bribery going on, because someone decided sharepoint was a good idea.
coding123 2y ago
Has anyone else noticed it's not possible to have an account that you can log in anymore? Locked out by AI, locked out by suspicious activity, locked out due to lost phone, lost authy, broken everything. You drive an RV? locked out due to location change. You have a common name? Locked out. Have a foreign name? Locked out.
concernedctzn 2y ago
using microsoft authenticator I just ran into this recently and searched to find it's a known issue that microsoft has no announced plan of fixing. Strange to see it pop up here separately, I guess it's becoming more common. I knew to cancel the dialogue and manually add the account without the QR code to workaround it but I'm sure plenty of people will have their accounts locked because of this
- datavirtue 2y ago
  I need a good authenticator app, I guess. I'm using Microsoft's and have a lot of different stuff in there. I may have run into this already but don't know it.
  - pndy 2y ago
    Try 2FAS - it works without cloud, can import from few other apps (sadly not from Microsoft one) and can export from and import to a file. Works on Android and iOS https://2fas.com/ https://2fas.com/
todotask 2y ago
One of this reason, I can think of having Passkey can be a better advantage over relying on centralised account management?
NikhilVerma 2y ago
A similar thing has happened with Twitter. After the Musk takeover and the removal of SMS for auth something has changed they keys of the 2FA authenticator. My old keys don't work and my "ticket" has been waiting on Twitter support (which were probably all fired) for resolution.
deleted 2y ago
[deleted]
justinclift 2y ago
"Microsoft is the Boeing of software." Seems like an apt description. :)
t00 2y ago
Even for Microsoft accounts, use an alternative app for 2FA/MFA. Recently I switched to the open source Aegis, which allows encrypted backups and does not have the issue described.
- iggldiggl 2y ago
  Doesn't help for those cases where an organisation is enforcing Authenticator usage, though.
- dddw 2y ago
  Aegis is the best
kaffeeringe 2y ago
It also tracks your position all the time. That is the bigger problem to me. https://reports.exodus-privacy.eu.org/de/reports/com.azure.authenticator/latest/ https://reports.exodus-privacy.eu.org/de/reports/com.azure.a...
- vladvasiliu 2y ago
  Interesting, on iOS it didn't even ask to use the location. Do they do it because they can? Haven't used Android in a long time, but I had the impression that they also introduced finer-grained permissions, as opposed to blanket approve / deny everything the app asks for.
  - rmholt 2y ago
    Android definitely has fine grained permissions. In fact my phone asks me each time a new app wants to use my location. Interestingly enough, I don't recall seeing a location prompt for Google's services
    - vladvasiliu 2y ago
      > I don't recall seeing a location prompt for Google's services I don't recall a prompt for Apple's services, either. But you can revoke the permission, at least for some of them.
- Mathnerd314 2y ago
  > This report lists trackers signatures found by static analysis in this APK. This is not a proof of activity of these trackers.
KMag 2y ago
I lost a few GMail accounts because I changed countries and computers since I created them. I tried logging in, Google said my password was correct, but both the device and the IP were unfamiliar. I don't recall exactly what was wrong with using the recovery address to recover from the problem, but that didn't work, despite my still having access to my recovery email address. I think I might need to be able to tell Google what my recovery email address is, and I may have used one of those randomized + suffixes to my recovery address. I used to use Google Authenticator with my GMail accounts, but disabled that out of fears it's just one more thing to go wrong, with Google providing little recourse. My password is a bit over 96 bits of entropy, generated by extracting 256 bits from /dev/urandom as a multi-precision integer, divmod'ing to extract one instance from each of the character classes (digit, lower, uppper, symbol) and then the rest from the combined alphabet (digit + lower + upper + symbol), and finally the leftover entropy used for Fisher-Yates shuffle of the password so the first digit isn't always a digit, etc. Passwords are per-site, stored using a gpg-based password manager I wrote in the early 2000s. MFA would still help for some types of ongoing active compromise, but not for dumps of password hashes from a DB compromise. It really kills me that recovery from my recovery email address doesn't work, even though I know my password. Honestly, if you haven't logged in from anywhere in a few months and you have the correct password, they should at least just send some verification link/code to your recovery address without requiring you to tell them your recovery address. Sure, maybe don't say where you're sending the recovery link, but turning the recovery address into another password you need to memorize without ever telling you it's some weird combination of recovery email address and recovery password is just highly annoying.
- aflag 2y ago
  And the fact that there's no one to talk to means that if computer says no, that's it.
  - alchemist1e9 2y ago
    There is absolutely nobody. It’s crazy. Realizing how dependent I am on gmail has been scary. I’ve started a project to attempt to move to my own domain and self hosting full email stack. It’s a huge amount of work. However the power Google has over me, should my gmail account be hijacked or turned off is incredible. Starting from the bottom is the security of the domain registrar and DNS records. It looks like there are some good options, though obviously with additional price. Basically you have to use the corporate services with additional security features. The self-hosting email and server security is something I have the background to handle.
franga2000 2y ago
> leaving IT experts wondering, ‘Why would you pick Microsoft?’ Well I can tell you why people pick MS Authenticator - it's because microsoft basically forces it on you, uses dark patterns to avoid letting you use any other standard OTP app and doesn't give admins the tools to disable it. As an admin, I can disable every single MFA method individually, including TOTP, but Microsoft Authenticator is force-enabled. When users go to enable TOTP (or are forced to), the option is called "Microsoft Authenticator", not something more generic. The QR code they get is not a standard TOTP one, so any other client will reject it. There's a small link below it letting you "use another app" which finally gives you a real TOTP QR code. This is INSANE!
- kaveet 2y ago
  Microsoft admin isn’t my day job, but I dealt with this exact thing the other day—the toggles for Microsoft Defender MFA are spread across Entra ID policies, Registration Campaigns, per-user settings, and more Microsoft subdomains I’d never heard of. After two hours the best I could do was add a Skip button to the MFA prompt when our users sign in.
- surfingdino 2y ago
  That's how they play https://en.wikipedia.org/wiki/United_States_v._Microsoft_Corp https://en.wikipedia.org/wiki/United_States_v._Microsoft_Cor.... https://en.wikipedia.org/wiki/Criticism_of_Microsoft https://en.wikipedia.org/wiki/Criticism_of_Microsoft
- ncr100 2y ago
  Lawsuit? Were these folks defrauded out of money due to the extra costs incurred?
- Spooky23 2y ago
  In enterprise, subscription utilization is what pays the sales team. They are eventually get canned if you don’t use the suite. They’ll send some goons to let the CEO/CFO know you are a spendthrift.
- devjab 2y ago
  I use the MS app for work, as it’s required as you say. I’m not sure our first-line support really minds though, as if people weren’t using this then they would be supporting a range of apps. It’s obviously unfortunate that it sort of sucks for them that they have to reset these things for people all the time, but I guess it’s the lesser of multiple evils. That being said, maybe we should advise employees that they shouldn’t use it for personal things even though they have it as it sucks.
nottorp 2y ago
Yes, when you add one more device between you and your data you are now dependent on it functioning correctly. Today it's a MS fuckup, but any such system could malfunction.
EGreg 2y ago
I have been recommending for years that people have a DIFFERENT email alias for evey service Email aliases look like yourname+somealias@gmail.com This also helps avoid social engineering attacks when people call into your provider: https://www.wired.com/2012/08/apple-amazon-mat-honan-hacking/ https://www.wired.com/2012/08/apple-amazon-mat-honan-hacking...
mihaaly 2y ago
"it was the fault of users or companies that use the app for authentication" MS said. Spot on right. They should have been more prudent in selecting services. Absolutely right, users' and clients' fault it is! You see a smug bastard company that hurts the client they live on because they provide faulty service, they hurt repeatedly, in thick queue throughout time, for long time, fault after fault after fault and just release the smear the responsibility elsewhere department on the clients complaining, whatever the official title of this department is, PR or whatever, while the issues are reported in news everywhere, publicised, then who would you blame? The company, or the clients still choosing the company against common sense and own experience? The case touches me because I am approaching a job where I would not use Windows anymore, I am tired of the Windows ecosystem. It only makes life differently complicated, or many times more complicated, more difficult to do my job than without it. I have not enough time listing how many things they made much worse in the past decade or more that my every day is a swimm through the flow of piss MS releases day after day at all of us. They were better in some short period long ago, only partially still, after some very bad historic period, now they are determined that with hard work they will f up all what is left. I have a friend working on the MS Teams. He is very busy, working hard, they will release some sort of AR meet feature, packed with complex and revolutionary (i.e. experimental) approaches so you could enjoy solutions that probably will work ok and not annoy you with visual artefacts and problems not eliminated before release, with the headset you require for it, probably will not be forced on you but likely annoy the hell out of you by the pop up promotions when you try to do your urgent job after a critical update. Who the f needs that? While the Teams is a mess to work with already with lots of noise and half cooked bloated whatevers already being a distaction, not helpful, not at all. Probably only the call quality is the only good in it by now, but that was purchased from elsewhere, that was given to them. They are so good making things too complicated and being unable making it well because it is too complicated to do well, too expensive, so let's just release a half cooked one and leave it there for decades (like the dialogs in Windows) and put the blame on elsewhere by the put the blame on elsewhere department put together precisely for this.
briffid 2y ago
I have many accounts with the same user names, and they don't get overwritten. There might be some design flaw somewhere, but it's surely not what the article states, ie. that you cannot have the same username on different sites.
- mattmaroon 2y ago
  Same. I mean I don’t doubt some bug exists, but I use it on iOS, almost always with QR codes and the same email address with no issues. I quite like the product. I switched from Google and it’s been much better. I am sure whatever is going on, it’s a bug and not a feature.
todotask 2y ago
When I tried to sign up for Hotmail account, the challenging step I have to solve isn't friendly for my impaired eyesight.
- 5350-uiop-1130 2y ago
  this is really a serious problem. some of those captchas are bordering on hostile. a lot of things are designed with total disregard for access try to zoom your phone and half the buttons your apps will disappear enable "zoomed" on iPadOS and you can longer scroll to the bottom of long settings menus. so many things
  - todotask 2y ago
    I gave up when the rounds to solve increased to 20, iirc.
arianvanp 2y ago
Safari had a similar bug where it would just overwrite your passkey with no warning whatsoever -- completely locking you out of your account. It has since then be fixed but this caused me to lose access to my GitHub https://bugs.webkit.org/show_bug.cgi?id=270553 https://bugs.webkit.org/show_bug.cgi?id=270553 Safari still has some bugs where it can't discern between websites hosted on different Subdomains except for hardcoded exceptions and it will override password of one subdomain with the other. Happens to me on a monthly basis.
- bobbylarrybobby 2y ago
  Keychain’s warnings that I was reusing passwords across StackOverflow and the StackExchange subdomains are part of what drove me to use a third party password manager that can manually add multiple sites to an entry, but I didn't realize this stupidity went even deeper.
__jonas 2y ago
Odd, I just received this email from MS that looks a lot like phishing but seems not to be? > Action required: Enable multifactor authentication for your tenant by 15 October 2024 > You’re receiving this email because you’re a global administrator for [Literally a UUID here, no organization name or anything] Starting 15 October 2024, we will require users to use multifactor authentication (MFA) to sign into the Azure portal, Microsoft Entra admin center, and Intune admin center. To ensure your users maintain access, you’ll need to enable MFA by 15 October 2024. > If you can’t enable MFA for your users by that date, you’ll need to apply to postpone the enforcement date. If you don’t, your users will be required to set up MFA. > Action required > To identify which users are signing into Azure with and without MFA, refer to our documentation. > To ensure your users can access the Azure portal, Microsoft Entra admin center, and Intune admin center, enable MFA for your users by 15 October 2024. > If you can’t enable MFA by 15 October 2024, apply to postpone the enforcement date. The thing is, I'm not administrating any organization with Microsoft. I have a private office365 family account or whatever it's called, and I have 2FA set up for my account, I have no idea what they are on about, especially because the email doesn't contain even my name or the name of the supposed organization, just some ID. It's definitely an Email from Microsoft though.
- cheschire 2y ago
  Login to azure portal. You should see a similar message that redirects you to the relevant resource
  - __jonas 2y ago
    Spot on! It was in fact some Azure account I made years ago, in hindsight, it did say to log into the azure portal right in the email. The random UUID instead of salutation threw me off a bit.
xattt 2y ago
I don’t see what the issue is. People could plan ahead and just write the six digit code in a notebook as a backup. /s
causality0 2y ago
Well damn. I've used Microsoft Authenticator for years and just happened to have never used the QR code feature. Is there an easy way to migrate all the data into Google Authenticator?
ta988 2y ago
This is not a software engineer issue, it is a product manager issue, whom relentlessly ignored users' complaints.
Obscurity4340 2y ago
KeePass, peeps
deleted 2y ago
[deleted]
websap 2y ago
wait a second, what? If I use the same email for another account, I could get randomly locked out from some other account. I just checked my app., there are 2 different emails for 2 entries, other entries are provider specific. Is there a good way to migrate from MS Authenticator and what options do I have? One of the entries without the Issuer correctly set is Outlook.com itself. WTF!
markuta 2y ago
What's also annoying is that some MFA providers like Microsoft Authenticator and Authy lock you into their platforms, no export or offline backups features, at least without a rooted phone.
addicted 2y ago
How has MS not fixed this. It seems like the kind of bug that shouldn’t ever happen in the first place (it’s such an obvious flaw) but now that they are aware, it should be priority #1 to fix.
parody577 2y ago
https://news.ycombinator.com/item?id=40523411 https://news.ycombinator.com/item?id=40523411
rpdillon 2y ago
One of the things I really like about the file system is that it's a sort of universal API: if you can get the files a program has written, then you can do all sorts of stuff, like version control them, back them up (and restore them!), sync them across machines, and develop interoperable tools. This is particularly useful with an application that provides TOTP codes. But modern mobile apps have an architecture that makes reading directly from the filesystem the exception, rather than the rule, which leads to apps directly managing all their data in their own database, rather than in a shared filesystem. This removes a lot of user agency, and opens the door to tough-to-remediate bugs, like a new version of the app corrupting or erasing old data. > Microsoft Authenticator will overwrite an account with the same username. Given the prominent use of email addresses for usernames, most users’ apps share the same username. Google Authenticator and just about every other authenticator app add the name of the issuer — such as a bank or a car company — to avoid this issue. Microsoft only uses the username. I feel like mobile took a step backward when it made the filesystem a second-class citizen, despite some of the security improvements mobile brought with app sandboxing. Restoring from a backup would have fully remediated this issue, at least once folks understood what was causing it.

497 points by miles 2y ago

Incidentally, this is why SMS MFA is so popular with users despite its security vulnerabilities. Generally, unless you are targeted by someone with a sim swap, it is good enough. Most people won't be targeted, but do have a good chance of something going wrong that makes them lose their MFA key.

SoftTalker 2y ago
Yep. It's simple, and almost everyone understands it. Like passwords themselves. Also the reason more secure approaches such as YubiKeys have never taken off in the general public -- they are just cumbersome and confusing.
- leftbehind 2y ago
  We haven't had any issue getting all of our staff -- nontechnical users alike -- on yubikeys. As part of education we skip the PKI portion and just point out that it is "like your physical house key. You plug it in and touch it to turn the key to unlock"
  - SoftTalker 2y ago
    Yes, and our staff uses ssh keys (generally but not always without issue) and a commercial MFA app. It's one thing to get this stuff used in a controlled environemnt where you have a help desk or administrators who can do a lot of the setup. You just hand the employee their YubiKey or smart card and say "use this." Trying to imagine your grandmother setting it up herself to be able to log in to her Facebook is another matter, and why these things have never worked for the general public.
  - close04 2y ago
    You probably use certificates and a company PKI to manage them. No need to stress if one is lost or locked, just revoke and whip up a new certificate. At home Yubikey is probably synonymous to FIDO not PIV/PKI. No whipping up a new one if you lose it. You better have 3 of them enrolled at any time, and have at least one stored off site.
    - leftbehind 2y ago
      We enroll them as standard fido/webauthn - I hate the other modes. I agree it requires significantly more work when you can't just call the locksmith for a new one -- IT -- if you lose one on your personal account you can only go get the spare key hidden under the doormat, a printed code in your safe, or lose the account.
  - Groxx 2y ago
    For business use, handing out yubikeys is completely reasonable - if they're lost or broken, the company is the authority and they can (and do) just re-issue a new one and work goes on with only a temporary interruption. They're easy to explain, fast to use, provide practical security, and are simple to recover in case of total failure. For personal use, that equation is wildly different. Google isn't going to let you attach a brand new key, you've just lost your account forever because it rained.
- JackSlateur 2y ago
  Most importantly: yubikeys must be bought
  - alistairSH 2y ago
    And carried around.
peanut-walrus 2y ago
Honestly, the only way I see forward is FIDO with dirt cheap NFC cards as keys. Need to log in to somewhere? Get the card from your wallet and touch it to your phone/laptop. It has to be cheap enough that for any company with paying customers it makes more sense to physically mail them a card if they don't already have one than to support any alternative auth methods. Most services won't even need a second layer of auth, if someone steals your wallet - do they really care about your reddit account?
immibis 2y ago
I've tried enabling it two times. The first time my phone permanently broke immediately after enabling it. The second time it was stolen. Now I just rely on randomly generated passwords.

SoftTalker 2y ago

"This is a small example of a big problem with usability and cybersecurity. This is what happens when apps are developed by engineers who don’t have a strong knowledge of customers" This really rings true. Just think of all the nonsense you have to deal with in the name of "security." Mandatory password change intervals. Insane rules for constructing passwords. Completely undocumented password requirements that you just have to figure out by trial and error. Complicated error messages full of security jargon. "Secret Questions" that you can't remember the answers to. And on the other side of the coin, the security of these systems themselves is like a sieve. So many data breaches, information disclosures, they are in the news almost daily. I often wonder how they get away with it all.

robertlagrant 2y ago
This isn't engineers doing that. It's CYA IT cyber policies.
- SahAssar 2y ago
  Sure, but a lot of engineers aren't completely blameless. They should push back and explain why these are bad choices just like I would expect a building engineer to say to me that cardboard is not the ideal load bearing element for my skyscraper. If the company still pushes forward with bad choices its on them, but they should be clearly informed how and why those choices are bad.
  - harimau777 2y ago
    Pushing back is a great way to lose your job or get past over for pay raises.
    - SahAssar 2y ago
      In bad orgs, yes. In good orgs you get appreciated for speaking up and communicating what will be future problems.

worble 2y ago

This boggles my brain on so many levels - are you telling me Microsoft Authenticator only stores the entry based on label? It doesn't generate an internal key or anything? And then they claim that the issue is websites not putting the issuer in the label, but in the issuer field, where it belongs? Is no-one at Microsoft actually using their own Authenticator? Unless I'm missing something, this would make it nearly unusable for almost all applications - as soon as you've used your email for one site you wouldn't be able to add it for any others?

SoftTalker 2y ago
From the article: "Microsoft hasn’t bothered to fix it because Microsoft Authenticator is a free product and therefore doesn’t generate revenue."
- deleted 2y ago
  [deleted]
- lostlogin 2y ago
  It’s actually worse than that. Given the opportunity to escape, I’m sure many would pay to to allowed to do so. Entering multi factor hell just to get into Teams is something I’d happily pay to avoid.
  - tialaramex 2y ago
    Assuming you use Microsoft Entra ("Azure Active Directory" as was), get your employer to enable the "preview" support for Security Keys. Why is it off by default? Well it's actually secure, and it would never do to provide a feature out of the box that actually works without lots of fiddling about, this is Microsoft, the consultant's friend. These seem to be relatively current instructions: https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-enable-passkey-fido2 https://learn.microsoft.com/en-us/entra/identity/authenticat... Having found a friendly sysadmin to do this, ask them to specifically not "Enforce key restrictions" which is theory could let your empoloyer require employees to use a specific issued authenticator credential - are they going to buy every employee an authenticator from a named brand? No? Then this must not be switched on, easy. Once this feature is enabled for you (you may be able to get them to switch it on for the whole org, or maybe for IT or whatever department you work in) you should be able to enrol a new Security Key the same way you'd add other MFA. So why go to all this bother? Because you can buy a Security Key that works how you want, a physical piece of hardware you own and can re-use - if you buy say the Yubico Security Key 2 in USB A, that goes in your USB A port on the laptop or dock and it just stays there. Its job is to be "Something you have" and the "Something you know" will be a PIN of your choosing (it literally doesn't leave your device, so corporate can't decide it should be the Password Game on steroids) No need for a phone or other unrelated device, no opening fiddly apps, no transcribing codes, you type your PIN and touch the sensor. If a PIN is too much, some pricier options take fingerprints, so then you just touch the sensor (with the correct finger)

magicalhippo 2y ago

I've been using Microsoft's one for my work accounts because, well, we're elbow deep into Office365 so why not. I've never gotten that dialog, and have not had any issues with the accounts I've added. Since they're my work accounts, 99% of them share my work email as account name. So does that mean I've just been lucky, in that the sites I've signed with have provided a sufficiently unique label? I feel I didn't fully get what the issue is.

muststopmyths 2y ago
Same. 3 personal accounts use the same email address. Two of them are FAANG and it all seems to fine (for going on a decade)
prng2021 2y ago
Seems like the bug is specific to the iOS app when scanning QR codes.
- magicalhippo 2y ago
  Ah, using Android so I guess that's why. Weird though, given that Microsoft claims it's an intentional feature. Why wouldn't a feature like that be implemented in both platforms? Even though it might be a dumb feature as seen from the users POV, it seems sufficiently special that it's something that I would assume one would want to have feature parity on.
  - mattmaroon 2y ago
    I’ve been using MS Authenticator for a long time, mainly on iOS and I’ve never experienced this bug.
- trustinmenowpls 2y ago
  That's me (iOS scan the QR code) and I've never encountered the bug either.
mihaaly 2y ago

breadwinner 2y ago

This happened to me when I updated MS Authenticator after not updating it for a while. It wiped out all data, and I got locked out of all accounts. MS Authenticator is not a carefully written product.

napsterbr 2y ago

Something similar happened to me about a year ago when the Google Authenticator app automatically updated to a new version. I lost all my accounts in the update process. Definitely learned a few lessons there.

xandrius 2y ago
This nightmare is why I always backup MFA QR codes and use those to add them to an open source app which let's me backup the data elsewhere too. Sorry to hear that!
- SoftTalker 2y ago
  Yep, any time I use an authenticator with an account I generate "backup codes" and keep them in my password manager. This saved me when I got a new phone and for some reason my Google Authenticator did not transfer to the new phone properly.
  - lostlogin 2y ago
    > Google Authenticator did not transfer to the new phone properly. This seems to be my normal experience with a new phone for MFA apps. I’m doing something wrong. That and setting up email are so dreaded that I hold off updating.
    - knallfrosch 2y ago
      Switching from Android to iOS for a phone, I found that Microsoft Authenticator officially doesn't support this. You can't backup, you can't transfer. Everything is lost, please start anew.
  - mook 2y ago
    I think they finally managed that last year, but only by syncing to your Google account: https://security.googleblog.com/2023/04/google-authenticator-now-supports.html https://security.googleblog.com/2023/04/google-authenticator... … Yeah I'm not sure that's very good for a 2FA app either. Offline backups feel better for me. I use something else for 2FA.

issafram 2y ago

ymmv, but I've never had this issue.

chaz6 2y ago

When asked to set up TOTP, the first thing I do is scan the QR code with a QR code reader, and save the secret into my password manager, before adding it to my authenticator app.

gleenn 2y ago
Does this actually work? I thought most TOTP codes were single use. Have you actually tried re-using them?
- Rychard 2y ago
  The initial QR code isn't a TOTP code, it contains the secret used to generate the TOTP codes.
- userbinator 2y ago
  The QR code contains the TOTP key, which is the seed that's used to generate the codes, which form a time-based pseudorandom sequence.
- smitelli 2y ago
  You can absolutely scan the QR code with multiple authenticator apps (or copy paste the seed value into them) and they will all produce the same codes in the same order going forward.
sleepycatgirl 2y ago
Oh, that's actually really nice, I should start doing the same thing myself
esafak 2y ago
1password lets you see it after you've saved it too.
- n8henrie 2y ago
  As does Bitwarden (just "edit" and it is revealed)

NotACracker 2y ago

I've just made a test: multiple accounts using the same account/email and there is no conflict. I even have a matching icon of the issuer for each entry; the issuer is registered for each entry. I am using the MS Authenticator for years and I've never had any problem of that sort, and of course, I am always using the same email as my account/username. Anyway, I'm just putting the result of my test. It's not like this going to change your mind about the authenticator or Microsoft itself here...

3np 2y ago
Which platform? Supposedly the issue ("feature") is specific to the iOS version?
- NotACracker 2y ago
  Android
- deleted 2y ago
  [deleted]

CatWChainsaw 2y ago

A whole different type of "too big to fail", and a great demonstration of why putting the keys to your kingdom in Microsoft's/Google's/Apple's hands is a stupid idea.

halfcat 2y ago
Is AWS any better, or what’s the solution? Most businesses aren’t technical and don’t need to be in the authentication/security business.
- CatWChainsaw 2y ago
  Greetings fellow feline, I am a microbiologist not IT. In that capacity, the only general suggestion is to have redundant authentication measures that cannot all be crippled by one source like this. I can't imagine it's popular, or easy, for a company to want to be able to use multiple authentication schemes, but this sort of situation shows why lock-in is a bad idea.

ReptileMan 2y ago

And keepass keeps complete history since the file was created. Someone was really sloppy in Microsoft in the design phase.

motohagiography 2y ago

some security products seem like they are designed to discredit security as a field. imo the market is just at the point of backlash against the decadent stupidity in that cost centre. if you are going to humiliate people by making them jump through hoops 10x a day with context switching 2FA tokens and make serious people with educations and responsibilities use words like "smishing," you better be sure that hoop is the finest example of engineering anywhere. the solution has become the problem. I'm calling the peak.

jokethrowaway 2y ago

Are we again in a Microsoft 2000 phase? It seems like everything Microsoft is broken these days. GitHub barely works after the acquisition. Azure is a joke. Teams is the bane of my existance. Outlook is the second one. Do they need to ask harder leetcoding problems during the interviews?

FridgeSeal 2y ago
Are they actually capable of releasing anything good? I guess C# isn’t horrible? It’s far from a language I want to use, but it’s not teams level of atrocious, so they’ve got that going for them I guess. VSCode is pretty good, but not good enough to stop me migrating off the second a more viable editor arrived. Word and office have degraded into a “doesn’t aggressively fail” sort of scenario, so they’re not “good” they’re just incumbent.
- elmo2you 2y ago
  > VSCode is pretty good, but not good enough to stop me migrating off the second a more viable editor arrived. If you're interested, there is VSCodium (VCCode without the Microsoft/proprietary parts). There's also Theia, if you want to take things a step further away from Microsoft. > I guess C# isn’t horrible? It’s far from a language I want to use, but it’s not teams level of atrocious, so they’ve got that going for them I guess. No clue if this is true for other companies, but I know a company that does big outsourcing project and most of them in C#/.NET and Angular. I've seen plenty of that code. My impression was/is that most of the C# code was extremely basic and mostly just tying together all ready-made libraries/features/frameworks/services (which Microsoft provides on their platforms/products) that actually made up the apps/services. C# itself just isn't all that much. Apart from maybe a gateway to guaranteed vendor lock-in. Maybe that is why they made sure to not mess that one up ;)
resource_waste 2y ago
Microsoft is a legacy company and soon to be zombie company. I think you'd be out of your mind to start a new company and use Microsoft for anything except Excel. The only reason my company seems to use it, we have software from the 2000s that only runs on Windows. Maybe there is some backdoor bribery going on, because someone decided sharepoint was a good idea.

coding123 2y ago

Has anyone else noticed it's not possible to have an account that you can log in anymore? Locked out by AI, locked out by suspicious activity, locked out due to lost phone, lost authy, broken everything. You drive an RV? locked out due to location change. You have a common name? Locked out. Have a foreign name? Locked out.

concernedctzn 2y ago

using microsoft authenticator I just ran into this recently and searched to find it's a known issue that microsoft has no announced plan of fixing. Strange to see it pop up here separately, I guess it's becoming more common. I knew to cancel the dialogue and manually add the account without the QR code to workaround it but I'm sure plenty of people will have their accounts locked because of this

datavirtue 2y ago
I need a good authenticator app, I guess. I'm using Microsoft's and have a lot of different stuff in there. I may have run into this already but don't know it.
- pndy 2y ago
  Try 2FAS - it works without cloud, can import from few other apps (sadly not from Microsoft one) and can export from and import to a file. Works on Android and iOS https://2fas.com/ https://2fas.com/

todotask 2y ago

One of this reason, I can think of having Passkey can be a better advantage over relying on centralised account management?

NikhilVerma 2y ago

A similar thing has happened with Twitter. After the Musk takeover and the removal of SMS for auth something has changed they keys of the 2FA authenticator. My old keys don't work and my "ticket" has been waiting on Twitter support (which were probably all fired) for resolution.

deleted 2y ago

[deleted]

justinclift 2y ago

"Microsoft is the Boeing of software." Seems like an apt description. :)

t00 2y ago

Even for Microsoft accounts, use an alternative app for 2FA/MFA. Recently I switched to the open source Aegis, which allows encrypted backups and does not have the issue described.

iggldiggl 2y ago
Doesn't help for those cases where an organisation is enforcing Authenticator usage, though.
dddw 2y ago
Aegis is the best

kaffeeringe 2y ago

It also tracks your position all the time. That is the bigger problem to me. https://reports.exodus-privacy.eu.org/de/reports/com.azure.authenticator/latest/ https://reports.exodus-privacy.eu.org/de/reports/com.azure.a...

vladvasiliu 2y ago
Interesting, on iOS it didn't even ask to use the location. Do they do it because they can? Haven't used Android in a long time, but I had the impression that they also introduced finer-grained permissions, as opposed to blanket approve / deny everything the app asks for.
- rmholt 2y ago
  Android definitely has fine grained permissions. In fact my phone asks me each time a new app wants to use my location. Interestingly enough, I don't recall seeing a location prompt for Google's services
  - vladvasiliu 2y ago
    > I don't recall seeing a location prompt for Google's services I don't recall a prompt for Apple's services, either. But you can revoke the permission, at least for some of them.
Mathnerd314 2y ago
> This report lists trackers signatures found by static analysis in this APK. This is not a proof of activity of these trackers.

KMag 2y ago

I lost a few GMail accounts because I changed countries and computers since I created them. I tried logging in, Google said my password was correct, but both the device and the IP were unfamiliar. I don't recall exactly what was wrong with using the recovery address to recover from the problem, but that didn't work, despite my still having access to my recovery email address. I think I might need to be able to tell Google what my recovery email address is, and I may have used one of those randomized + suffixes to my recovery address. I used to use Google Authenticator with my GMail accounts, but disabled that out of fears it's just one more thing to go wrong, with Google providing little recourse. My password is a bit over 96 bits of entropy, generated by extracting 256 bits from /dev/urandom as a multi-precision integer, divmod'ing to extract one instance from each of the character classes (digit, lower, uppper, symbol) and then the rest from the combined alphabet (digit + lower + upper + symbol), and finally the leftover entropy used for Fisher-Yates shuffle of the password so the first digit isn't always a digit, etc. Passwords are per-site, stored using a gpg-based password manager I wrote in the early 2000s. MFA would still help for some types of ongoing active compromise, but not for dumps of password hashes from a DB compromise. It really kills me that recovery from my recovery email address doesn't work, even though I know my password. Honestly, if you haven't logged in from anywhere in a few months and you have the correct password, they should at least just send some verification link/code to your recovery address without requiring you to tell them your recovery address. Sure, maybe don't say where you're sending the recovery link, but turning the recovery address into another password you need to memorize without ever telling you it's some weird combination of recovery email address and recovery password is just highly annoying.

aflag 2y ago
And the fact that there's no one to talk to means that if computer says no, that's it.
- alchemist1e9 2y ago
  There is absolutely nobody. It’s crazy. Realizing how dependent I am on gmail has been scary. I’ve started a project to attempt to move to my own domain and self hosting full email stack. It’s a huge amount of work. However the power Google has over me, should my gmail account be hijacked or turned off is incredible. Starting from the bottom is the security of the domain registrar and DNS records. It looks like there are some good options, though obviously with additional price. Basically you have to use the corporate services with additional security features. The self-hosting email and server security is something I have the background to handle.

franga2000 2y ago

> leaving IT experts wondering, ‘Why would you pick Microsoft?’ Well I can tell you why people pick MS Authenticator - it's because microsoft basically forces it on you, uses dark patterns to avoid letting you use any other standard OTP app and doesn't give admins the tools to disable it. As an admin, I can disable every single MFA method individually, including TOTP, but Microsoft Authenticator is force-enabled. When users go to enable TOTP (or are forced to), the option is called "Microsoft Authenticator", not something more generic. The QR code they get is not a standard TOTP one, so any other client will reject it. There's a small link below it letting you "use another app" which finally gives you a real TOTP QR code. This is INSANE!

kaveet 2y ago
Microsoft admin isn’t my day job, but I dealt with this exact thing the other day—the toggles for Microsoft Defender MFA are spread across Entra ID policies, Registration Campaigns, per-user settings, and more Microsoft subdomains I’d never heard of. After two hours the best I could do was add a Skip button to the MFA prompt when our users sign in.
surfingdino 2y ago
That's how they play https://en.wikipedia.org/wiki/United_States_v._Microsoft_Corp https://en.wikipedia.org/wiki/United_States_v._Microsoft_Cor.... https://en.wikipedia.org/wiki/Criticism_of_Microsoft https://en.wikipedia.org/wiki/Criticism_of_Microsoft
ncr100 2y ago
Lawsuit? Were these folks defrauded out of money due to the extra costs incurred?
Spooky23 2y ago
In enterprise, subscription utilization is what pays the sales team. They are eventually get canned if you don’t use the suite. They’ll send some goons to let the CEO/CFO know you are a spendthrift.
devjab 2y ago
I use the MS app for work, as it’s required as you say. I’m not sure our first-line support really minds though, as if people weren’t using this then they would be supporting a range of apps. It’s obviously unfortunate that it sort of sucks for them that they have to reset these things for people all the time, but I guess it’s the lesser of multiple evils. That being said, maybe we should advise employees that they shouldn’t use it for personal things even though they have it as it sucks.

nottorp 2y ago

Yes, when you add one more device between you and your data you are now dependent on it functioning correctly. Today it's a MS fuckup, but any such system could malfunction.

EGreg 2y ago

I have been recommending for years that people have a DIFFERENT email alias for evey service Email aliases look like yourname+somealias@gmail.com This also helps avoid social engineering attacks when people call into your provider: https://www.wired.com/2012/08/apple-amazon-mat-honan-hacking/ https://www.wired.com/2012/08/apple-amazon-mat-honan-hacking...

mihaaly 2y ago

"it was the fault of users or companies that use the app for authentication" MS said. Spot on right. They should have been more prudent in selecting services. Absolutely right, users' and clients' fault it is! You see a smug bastard company that hurts the client they live on because they provide faulty service, they hurt repeatedly, in thick queue throughout time, for long time, fault after fault after fault and just release the smear the responsibility elsewhere department on the clients complaining, whatever the official title of this department is, PR or whatever, while the issues are reported in news everywhere, publicised, then who would you blame? The company, or the clients still choosing the company against common sense and own experience? The case touches me because I am approaching a job where I would not use Windows anymore, I am tired of the Windows ecosystem. It only makes life differently complicated, or many times more complicated, more difficult to do my job than without it. I have not enough time listing how many things they made much worse in the past decade or more that my every day is a swimm through the flow of piss MS releases day after day at all of us. They were better in some short period long ago, only partially still, after some very bad historic period, now they are determined that with hard work they will f up all what is left. I have a friend working on the MS Teams. He is very busy, working hard, they will release some sort of AR meet feature, packed with complex and revolutionary (i.e. experimental) approaches so you could enjoy solutions that probably will work ok and not annoy you with visual artefacts and problems not eliminated before release, with the headset you require for it, probably will not be forced on you but likely annoy the hell out of you by the pop up promotions when you try to do your urgent job after a critical update. Who the f needs that? While the Teams is a mess to work with already with lots of noise and half cooked bloated whatevers already being a distaction, not helpful, not at all. Probably only the call quality is the only good in it by now, but that was purchased from elsewhere, that was given to them. They are so good making things too complicated and being unable making it well because it is too complicated to do well, too expensive, so let's just release a half cooked one and leave it there for decades (like the dialogs in Windows) and put the blame on elsewhere by the put the blame on elsewhere department put together precisely for this.

briffid 2y ago

I have many accounts with the same user names, and they don't get overwritten. There might be some design flaw somewhere, but it's surely not what the article states, ie. that you cannot have the same username on different sites.

mattmaroon 2y ago
Same. I mean I don’t doubt some bug exists, but I use it on iOS, almost always with QR codes and the same email address with no issues. I quite like the product. I switched from Google and it’s been much better. I am sure whatever is going on, it’s a bug and not a feature.

todotask 2y ago

When I tried to sign up for Hotmail account, the challenging step I have to solve isn't friendly for my impaired eyesight.

5350-uiop-1130 2y ago
this is really a serious problem. some of those captchas are bordering on hostile. a lot of things are designed with total disregard for access try to zoom your phone and half the buttons your apps will disappear enable "zoomed" on iPadOS and you can longer scroll to the bottom of long settings menus. so many things
- todotask 2y ago
  I gave up when the rounds to solve increased to 20, iirc.

arianvanp 2y ago

Safari had a similar bug where it would just overwrite your passkey with no warning whatsoever -- completely locking you out of your account. It has since then be fixed but this caused me to lose access to my GitHub https://bugs.webkit.org/show_bug.cgi?id=270553 https://bugs.webkit.org/show_bug.cgi?id=270553 Safari still has some bugs where it can't discern between websites hosted on different Subdomains except for hardcoded exceptions and it will override password of one subdomain with the other. Happens to me on a monthly basis.

bobbylarrybobby 2y ago
Keychain’s warnings that I was reusing passwords across StackOverflow and the StackExchange subdomains are part of what drove me to use a third party password manager that can manually add multiple sites to an entry, but I didn't realize this stupidity went even deeper.

__jonas 2y ago

Odd, I just received this email from MS that looks a lot like phishing but seems not to be? > Action required: Enable multifactor authentication for your tenant by 15 October 2024 > You’re receiving this email because you’re a global administrator for [Literally a UUID here, no organization name or anything] Starting 15 October 2024, we will require users to use multifactor authentication (MFA) to sign into the Azure portal, Microsoft Entra admin center, and Intune admin center. To ensure your users maintain access, you’ll need to enable MFA by 15 October 2024. > If you can’t enable MFA for your users by that date, you’ll need to apply to postpone the enforcement date. If you don’t, your users will be required to set up MFA. > Action required > To identify which users are signing into Azure with and without MFA, refer to our documentation. > To ensure your users can access the Azure portal, Microsoft Entra admin center, and Intune admin center, enable MFA for your users by 15 October 2024. > If you can’t enable MFA by 15 October 2024, apply to postpone the enforcement date. The thing is, I'm not administrating any organization with Microsoft. I have a private office365 family account or whatever it's called, and I have 2FA set up for my account, I have no idea what they are on about, especially because the email doesn't contain even my name or the name of the supposed organization, just some ID. It's definitely an Email from Microsoft though.

cheschire 2y ago
Login to azure portal. You should see a similar message that redirects you to the relevant resource
- __jonas 2y ago
  Spot on! It was in fact some Azure account I made years ago, in hindsight, it did say to log into the azure portal right in the email. The random UUID instead of salutation threw me off a bit.

xattt 2y ago

I don’t see what the issue is. People could plan ahead and just write the six digit code in a notebook as a backup. /s

causality0 2y ago

Well damn. I've used Microsoft Authenticator for years and just happened to have never used the QR code feature. Is there an easy way to migrate all the data into Google Authenticator?

ta988 2y ago

This is not a software engineer issue, it is a product manager issue, whom relentlessly ignored users' complaints.

Obscurity4340 2y ago

KeePass, peeps

deleted 2y ago

[deleted]

websap 2y ago

wait a second, what? If I use the same email for another account, I could get randomly locked out from some other account. I just checked my app., there are 2 different emails for 2 entries, other entries are provider specific. Is there a good way to migrate from MS Authenticator and what options do I have? One of the entries without the Issuer correctly set is Outlook.com itself. WTF!

markuta 2y ago

What's also annoying is that some MFA providers like Microsoft Authenticator and Authy lock you into their platforms, no export or offline backups features, at least without a rooted phone.

addicted 2y ago

How has MS not fixed this. It seems like the kind of bug that shouldn’t ever happen in the first place (it’s such an obvious flaw) but now that they are aware, it should be priority #1 to fix.

parody577 2y ago

https://news.ycombinator.com/item?id=40523411 https://news.ycombinator.com/item?id=40523411

rpdillon 2y ago

One of the things I really like about the file system is that it's a sort of universal API: if you can get the files a program has written, then you can do all sorts of stuff, like version control them, back them up (and restore them!), sync them across machines, and develop interoperable tools. This is particularly useful with an application that provides TOTP codes. But modern mobile apps have an architecture that makes reading directly from the filesystem the exception, rather than the rule, which leads to apps directly managing all their data in their own database, rather than in a shared filesystem. This removes a lot of user agency, and opens the door to tough-to-remediate bugs, like a new version of the app corrupting or erasing old data. > Microsoft Authenticator will overwrite an account with the same username. Given the prominent use of email addresses for usernames, most users’ apps share the same username. Google Authenticator and just about every other authenticator app add the name of the issuer — such as a bank or a car company — to avoid this issue. Microsoft only uses the username. I feel like mobile took a step backward when it made the filesystem a second-class citizen, despite some of the security improvements mobile brought with app sandboxing. Restoring from a backup would have fully remediated this issue, at least once folks understood what was causing it.