> To add insult to injury, MS Auth can only have one account per email address (id@realm/whatever you want to call it) When this was discussed [1] on HN a few

> To add insult to injury, MS Auth can only have one account per email address (id@realm/whatever you want to call it) When this was discussed [1] on HN a few weeks ago, I don't recall anyone reporting reproducing it. Several people, including me, reported having many accounts in MS Authenticator that have the same email address with no problem. The otpauth URI that is encoded in a TOTP QR code looks like this: otpauth://totp/LABEL?parameter_list The LABEL is supposed to serve as a unique identifier for the account. It has the format "Issuer:Account". The "Account" part is required. The "Issuer" is optional (and the ":" omitted if the issuer is not present). The parameter list is an & separated list of name=value pairs. It includes the "secret" parameter which gives the TOTP secret. An optional parameter is "issuer", which should match the "issuer" part of the label if that is present. It sounds like what is happening is that there are some sites who do not include the "issuer" part the the label, and they let the user use a user provided email address as the account name. If a given user uses two such sites and provides the same email address to both, then there will be a collision. If they also do not include an issuer parameter an authenticator app has no way to know just from the data in the codes that they are from different sites. [1] https://news.ycombinator.com/item?id=41275846 https://news.ycombinator.com/item?id=41275846