4 ms·

This boggles my brain on so many levels - are you telling me Microsoft Authenticator only stores the entry based on label? It doesn't generate an internal key o

by worble 2y ago

This boggles my brain on so many levels - are you telling me Microsoft Authenticator only stores the entry based on label? It doesn't generate an internal key or anything? And then they claim that the issue is websites not putting the issuer in the label, but in the issuer field, where it belongs? Is no-one at Microsoft actually using their own Authenticator? Unless I'm missing something, this would make it nearly unusable for almost all applications - as soon as you've used your email for one site you wouldn't be able to add it for any others?

SoftTalker 2y ago
From the article: "Microsoft hasn’t bothered to fix it because Microsoft Authenticator is a free product and therefore doesn’t generate revenue."
- deleted 2y ago
  [deleted]
- lostlogin 2y ago
  It’s actually worse than that. Given the opportunity to escape, I’m sure many would pay to to allowed to do so. Entering multi factor hell just to get into Teams is something I’d happily pay to avoid.
  - tialaramex 2y ago
    Assuming you use Microsoft Entra ("Azure Active Directory" as was), get your employer to enable the "preview" support for Security Keys. Why is it off by default? Well it's actually secure, and it would never do to provide a feature out of the box that actually works without lots of fiddling about, this is Microsoft, the consultant's friend. These seem to be relatively current instructions: https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-enable-passkey-fido2 https://learn.microsoft.com/en-us/entra/identity/authenticat... Having found a friendly sysadmin to do this, ask them to specifically not "Enforce key restrictions" which is theory could let your empoloyer require employees to use a specific issued authenticator credential - are they going to buy every employee an authenticator from a named brand? No? Then this must not be switched on, easy. Once this feature is enabled for you (you may be able to get them to switch it on for the whole org, or maybe for IT or whatever department you work in) you should be able to enrol a new Security Key the same way you'd add other MFA. So why go to all this bother? Because you can buy a Security Key that works how you want, a physical piece of hardware you own and can re-use - if you buy say the Yubico Security Key 2 in USB A, that goes in your USB A port on the laptop or dock and it just stays there. Its job is to be "Something you have" and the "Something you know" will be a PIN of your choosing (it literally doesn't leave your device, so corporate can't decide it should be the Password Game on steroids) No need for a phone or other unrelated device, no opening fiddly apps, no transcribing codes, you type your PIN and touch the sensor. If a PIN is too much, some pricier options take fingerprints, so then you just touch the sensor (with the correct finger)
    - technion 2y ago
      Security keys don't work with android phones when you want to logon to m365 email. This is a showstopper for a lot of people.
      - fragmede 2y ago
        I moved the usb-c yubikey in my laptop to my Android phone and was able to login to my m365 calendar/mail/teams there, so it does work, as long as IT supports it.
    - lostlogin 2y ago
      Thank you.
    - userbinator 2y ago
      Or enable the option to use any standard TOTP authenticator.
    - franga2000 2y ago
      > goes in your USB A port on the laptop or dock and it just stays there If it's always there, then why isn't it just a file on the disk? Why should I need to buy a new piece of hardware and permanently sacrifice one of my USB ports. Client certs have been the "something you own" for decades and the main problem with them was that using them didn't involve any JavaScript, which is blasphemy in modern web dev and so they were killed (with the help of EU bureaucrats). And now that basically every computer has a TPM, you can even satisfy the "not extractable" requirement, which was the only actual advantage of a yubikey.
      - fragmede 2y ago
        That's what passkeys are.
      - vel0city 2y ago
        > why isn't it just a file on the disk? Because if done properly it can't be trivially cloned.
- mihaaly 2y ago
  Hermione Granger would say: What an idiot! Only almost all and increasing number of their revenue producing product depends on this being reliable, or at least have no bad reputation being unreliable. As the reputation is what many corporate ballonheads only care about. Still, hurt that too in their incompetent bencounter singlemindedness.
marcosdumay 2y ago
> Is no-one at Microsoft actually using their own Authenticator? At most, I'd expect people to only use it for work, where Microsoft is the only issuer. I also expect lots and lots of people to not use it.
tzs 2y ago
> Unless I'm missing something, this would make it nearly unusable for almost all applications - as soon as you've used your email for one site you wouldn't be able to add it for any others? Yeah, something is not making sense here. I've got multiple accounts with the same email and just compared the codes from Authenticator, which is my backup TOTP app, with the correct codes and Authenticator agreed. I did find a UI problem that could lead to a user getting the wrong code. When the first few accounts are on the screen and it is time to refresh the codes the ones on screen refresh every 30 seconds. The ones offscreen do not. When I scroll to bring offscreen codes into view they show an older code. In one case the code that scrolled in was 4 codes behind the correct code.
- Mathnerd314 2y ago
  I've scanned two Facebook codes in sequence, the second Facebook code overwrote the first. Maybe that is the issue.
alienchow 2y ago
Along the same grain, Google, the search powerhouse, releases Google Authenticator with no search bar in the Android version. And continues to wilfully not include one despite multiple feature requests. Yet there's a search bar in the iOS version. Just why? I'm willing to bet that in that gigantic Piper repo, there's already a local search library that they could just drop in in a single CL. But that's not LLM.
- whartung 2y ago
  When I bought a new phone and moved all my stuff over from a backup of my original phone, apparently the Google Authenticator doesn’t back something up. When I launched GA all of my 2FA data was gone. Thankfully I had my backup codes. And I could also still use the old one on the old phone. But the nightmare potential is quite high.
  - Cyykratahk 2y ago
    For a long time GA had no method to back up or extract the data. It also excluded itself from ADB backups. One had to root their phone to extract the data.
  - remolueoend 2y ago
    Aegis [1] seems to be a great alternative, at least on Android. Besides a search bar, it allows you to backup or export all your entries in an ecrypted vault. You can also include them in the Android cloud backups. [1] https://github.com/beemdevelopment/Aegis https://github.com/beemdevelopment/Aegis
    - jamaicahest 2y ago
      An alternative in sitautions where OTP-only is allowed. E.g. I work as a freelance contractor and every single customer requires MFA with GPS tracking. Some also require accessing Bluetooth on the phone.
  - ClassyJacket 2y ago
    Google authenticator is absolutely horrible. Until recently there was just no way to back it up, at all. If you were getting rid of your phone, well, tough shit.
mihaaly 2y ago
They likely use for one account only, their MS account at work, where it is forced, but not elsewhere because they know it suck.
deleted 2y ago
[deleted]

by worble 2y ago

SoftTalker 2y ago

From the article: "Microsoft hasn’t bothered to fix it because Microsoft Authenticator is a free product and therefore doesn’t generate revenue."

deleted 2y ago
[deleted]
lostlogin 2y ago
It’s actually worse than that. Given the opportunity to escape, I’m sure many would pay to to allowed to do so. Entering multi factor hell just to get into Teams is something I’d happily pay to avoid.
- tialaramex 2y ago
  Assuming you use Microsoft Entra ("Azure Active Directory" as was), get your employer to enable the "preview" support for Security Keys. Why is it off by default? Well it's actually secure, and it would never do to provide a feature out of the box that actually works without lots of fiddling about, this is Microsoft, the consultant's friend. These seem to be relatively current instructions: https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-enable-passkey-fido2 https://learn.microsoft.com/en-us/entra/identity/authenticat... Having found a friendly sysadmin to do this, ask them to specifically not "Enforce key restrictions" which is theory could let your empoloyer require employees to use a specific issued authenticator credential - are they going to buy every employee an authenticator from a named brand? No? Then this must not be switched on, easy. Once this feature is enabled for you (you may be able to get them to switch it on for the whole org, or maybe for IT or whatever department you work in) you should be able to enrol a new Security Key the same way you'd add other MFA. So why go to all this bother? Because you can buy a Security Key that works how you want, a physical piece of hardware you own and can re-use - if you buy say the Yubico Security Key 2 in USB A, that goes in your USB A port on the laptop or dock and it just stays there. Its job is to be "Something you have" and the "Something you know" will be a PIN of your choosing (it literally doesn't leave your device, so corporate can't decide it should be the Password Game on steroids) No need for a phone or other unrelated device, no opening fiddly apps, no transcribing codes, you type your PIN and touch the sensor. If a PIN is too much, some pricier options take fingerprints, so then you just touch the sensor (with the correct finger)
  - technion 2y ago
    Security keys don't work with android phones when you want to logon to m365 email. This is a showstopper for a lot of people.
    - fragmede 2y ago
      I moved the usb-c yubikey in my laptop to my Android phone and was able to login to my m365 calendar/mail/teams there, so it does work, as long as IT supports it.
  - lostlogin 2y ago
    Thank you.
  - userbinator 2y ago
    Or enable the option to use any standard TOTP authenticator.
  - franga2000 2y ago
    > goes in your USB A port on the laptop or dock and it just stays there If it's always there, then why isn't it just a file on the disk? Why should I need to buy a new piece of hardware and permanently sacrifice one of my USB ports. Client certs have been the "something you own" for decades and the main problem with them was that using them didn't involve any JavaScript, which is blasphemy in modern web dev and so they were killed (with the help of EU bureaucrats). And now that basically every computer has a TPM, you can even satisfy the "not extractable" requirement, which was the only actual advantage of a yubikey.
    - fragmede 2y ago
      That's what passkeys are.
    - vel0city 2y ago
      > why isn't it just a file on the disk? Because if done properly it can't be trivially cloned.
mihaaly 2y ago
Hermione Granger would say: What an idiot! Only almost all and increasing number of their revenue producing product depends on this being reliable, or at least have no bad reputation being unreliable. As the reputation is what many corporate ballonheads only care about. Still, hurt that too in their incompetent bencounter singlemindedness.

marcosdumay 2y ago

> Is no-one at Microsoft actually using their own Authenticator? At most, I'd expect people to only use it for work, where Microsoft is the only issuer. I also expect lots and lots of people to not use it.

tzs 2y ago

> Unless I'm missing something, this would make it nearly unusable for almost all applications - as soon as you've used your email for one site you wouldn't be able to add it for any others? Yeah, something is not making sense here. I've got multiple accounts with the same email and just compared the codes from Authenticator, which is my backup TOTP app, with the correct codes and Authenticator agreed. I did find a UI problem that could lead to a user getting the wrong code. When the first few accounts are on the screen and it is time to refresh the codes the ones on screen refresh every 30 seconds. The ones offscreen do not. When I scroll to bring offscreen codes into view they show an older code. In one case the code that scrolled in was 4 codes behind the correct code.

Mathnerd314 2y ago
I've scanned two Facebook codes in sequence, the second Facebook code overwrote the first. Maybe that is the issue.

alienchow 2y ago

Along the same grain, Google, the search powerhouse, releases Google Authenticator with no search bar in the Android version. And continues to wilfully not include one despite multiple feature requests. Yet there's a search bar in the iOS version. Just why? I'm willing to bet that in that gigantic Piper repo, there's already a local search library that they could just drop in in a single CL. But that's not LLM.

whartung 2y ago
When I bought a new phone and moved all my stuff over from a backup of my original phone, apparently the Google Authenticator doesn’t back something up. When I launched GA all of my 2FA data was gone. Thankfully I had my backup codes. And I could also still use the old one on the old phone. But the nightmare potential is quite high.
- Cyykratahk 2y ago
  For a long time GA had no method to back up or extract the data. It also excluded itself from ADB backups. One had to root their phone to extract the data.
- remolueoend 2y ago
  Aegis [1] seems to be a great alternative, at least on Android. Besides a search bar, it allows you to backup or export all your entries in an ecrypted vault. You can also include them in the Android cloud backups. [1] https://github.com/beemdevelopment/Aegis https://github.com/beemdevelopment/Aegis
  - jamaicahest 2y ago
    An alternative in sitautions where OTP-only is allowed. E.g. I work as a freelance contractor and every single customer requires MFA with GPS tracking. Some also require accessing Bluetooth on the phone.
- ClassyJacket 2y ago
  Google authenticator is absolutely horrible. Until recently there was just no way to back it up, at all. If you were getting rid of your phone, well, tough shit.

mihaaly 2y ago

They likely use for one account only, their MS account at work, where it is forced, but not elsewhere because they know it suck.

deleted 2y ago

[deleted]