4 ms·

Microsoft SSO/auth flows have that feel in general. Really feels like something hacked together. Some examples from the top off my mind: - In MS Authenticator,

by racked 2y ago

Microsoft SSO/auth flows have that feel in general. Really feels like something hacked together. Some examples from the top off my mind: - In MS Authenticator, having to click on each subject rather than just showing the code immediately. If Google's Authenticator can show the code, why can't MS's? - Azure DevOps randomly redirecting to the login form and back while already logged in. - Azure DevOps randomly opening an authentication popup (presumably some SSO stuff) and closing it again - Clunky-looking Office365 account management flows

Sylamore 2y ago
MS Authenticator will show the codes for TOTP if you go to the hamburger menu and select "show codes".
- racked 2y ago
  Hah, you're right. Thanks!
vladvasiliu 2y ago
I only very rarely use Azure DevOps, but that seems tame. If you have multiple accounts open in the same browser session, regular Azure portal won't remember which one you chose when opening in a new tab. If you got to a new tab by clicking a link, it will send you to select which account you want, then helpfully send you to the portal homepage, forgetting the initial URL. Well, that was before. Since a few days, they seem to have improved the experience, since they no longer ask which account I want to use, but helpfully pick the first on the list. No, they still don't remember which account was already being used when clicking the link. And no, switching accounts from the top-right icon doesn't keep you on your current page but sends you back to the portal homepage. Then there are other webapps which seem to implement their own login flow: they figure your session is expired, but don't allow you to switch accounts. The only way to use a different account from this flow is to sign out of the current one, which, of course, signs you out from everywhere. The solution is going to a different site, say myaccount, login with the second one, go back to the first site which now allows you to choose.
- uzerfcwn 2y ago
  > Then there are other webapps which seem to implement their own login flow: they figure your session is expired, but don't allow you to switch accounts. The only way to use a different account from this flow is to sign out of the current one, which, of course, signs you out from everywhere. Container tabs[1] are great for these. My work browser has a separate container for each of my frequently used Azure logins. When I need to use one of those pesky apps, I just open it in the respective container. [1] https://addons.mozilla.org/en-US/firefox/addon/multi-account-containers/ https://addons.mozilla.org/en-US/firefox/addon/multi-account...
  - vladvasiliu 2y ago
    I used to use those, too, but I’ve started using a yubikey and azure doesn’t support those on Firefox on Linux. So now I’ve begrudgingly switched to chromium for my azure-related needs, with separate profiles, which is a PITA compared to containers.
Spooky23 2y ago
Authenticator is buggy. When they made it easy to report vulnerabilities back in 2016-17, a colleague and I were able to pretty trivially compromise the product about 5 times during a PoC - and we weren’t trying to do so! The worst one involved hitting cancel 8 times in a certain window, which you let you in. Lol
hypeatei 2y ago
Yeah, DevOps is extremely bad with credential caching and refreshes. Sometimes after you elevate privileges, you'll see the privileged UI options and then they'll disappear on next page load.

by racked 2y ago

Sylamore 2y ago

MS Authenticator will show the codes for TOTP if you go to the hamburger menu and select "show codes".

racked 2y ago
Hah, you're right. Thanks!

vladvasiliu 2y ago

I only very rarely use Azure DevOps, but that seems tame. If you have multiple accounts open in the same browser session, regular Azure portal won't remember which one you chose when opening in a new tab. If you got to a new tab by clicking a link, it will send you to select which account you want, then helpfully send you to the portal homepage, forgetting the initial URL. Well, that was before. Since a few days, they seem to have improved the experience, since they no longer ask which account I want to use, but helpfully pick the first on the list. No, they still don't remember which account was already being used when clicking the link. And no, switching accounts from the top-right icon doesn't keep you on your current page but sends you back to the portal homepage. Then there are other webapps which seem to implement their own login flow: they figure your session is expired, but don't allow you to switch accounts. The only way to use a different account from this flow is to sign out of the current one, which, of course, signs you out from everywhere. The solution is going to a different site, say myaccount, login with the second one, go back to the first site which now allows you to choose.

uzerfcwn 2y ago
> Then there are other webapps which seem to implement their own login flow: they figure your session is expired, but don't allow you to switch accounts. The only way to use a different account from this flow is to sign out of the current one, which, of course, signs you out from everywhere. Container tabs[1] are great for these. My work browser has a separate container for each of my frequently used Azure logins. When I need to use one of those pesky apps, I just open it in the respective container. [1] https://addons.mozilla.org/en-US/firefox/addon/multi-account-containers/ https://addons.mozilla.org/en-US/firefox/addon/multi-account...
- vladvasiliu 2y ago
  I used to use those, too, but I’ve started using a yubikey and azure doesn’t support those on Firefox on Linux. So now I’ve begrudgingly switched to chromium for my azure-related needs, with separate profiles, which is a PITA compared to containers.

Spooky23 2y ago

Authenticator is buggy. When they made it easy to report vulnerabilities back in 2016-17, a colleague and I were able to pretty trivially compromise the product about 5 times during a PoC - and we weren’t trying to do so! The worst one involved hitting cancel 8 times in a certain window, which you let you in. Lol

hypeatei 2y ago

Yeah, DevOps is extremely bad with credential caching and refreshes. Sometimes after you elevate privileges, you'll see the privileged UI options and then they'll disappear on next page load.