3 ms·

I occasionally run into small biz employees running the mandated MS Authenticator (biz O365) on their personal devices. This makes me sad. I'm trialing Winauth

I occasionally run into small biz employees running the mandated MS Authenticator (biz O365) on their personal devices. This makes me sad. I'm trialing Winauth for some remote-only users. So far I'm happy with having the authenticator on Windows desktop. ref: https://github.com/winauth/winauth https://github.com/winauth/winauth

anotherhue 1y ago
ehh... for just one well behaved app I think it's tolerable. It's about where I draw the line though.
- WarOnPrivacy 1y ago
  Most every bit of online exchange and O365 (+the ever-changing, ever-growing stack of MS policy/admin/security panels) is overkill for 10-20 users who need mail, Outlook, Word, Excel (no substitutions). It's a massive hydra and it's most dependable output is onerous requirements. And the more of those we heap upon light duty users, the more reasonable it becomes to circumvent them. In this scenario Winauth is how we placate the unreasonable overlord.
adastra22 1y ago
What is sad about that?
- WarOnPrivacy 1y ago
  >> employees running corp MS Authenticator on their personal devices makes me sad. > What is sad about that? Why does it make me sad? That's a good question. Insufficient respect for employees' personal domain. Non-optimal IT defaults. - It sets up a scenario where the employee's personal device is co-opted without their full, meaningful consent. - It places work assets in a personal device. - It introduces a scenario where a critical function takes place outside of direct view and control of IT. Lastly and speculatively, it places Microsoft software in their device and Microsoft can't be trusted to keep it's hands to itself when it has an opportunity to be creepy, grabby or slimy. Examples: Slimy: Injects Bing links into phone's context menu when Outlook for Android app is installed. Grabby: History of sharing personal data with 700+ partners. Creepy: Relentlessly pushes CoPilot like horny drunk uncle pushes sex innuendos. refs: MS Authenticator Sandbox analysis: https://www.virustotal.com/gui/file/c165ea4f2c399f474f068087944052116aeb5df054577aa0a529fdfaa0805b33/details https://www.virustotal.com/gui/file/c165ea4f2c399f474f068087... https://kagi.com/search?q=How+is+Microsoft+like+a+creepy+uncle+when+it+relentlessly+pushes+copilot+on+users%3F&r=us&sh=eWJ_LBFqSpMhizM4uPhOaQ https://kagi.com/search?q=How+is+Microsoft+like+a+creepy+unc...
  - adastra22 1y ago
    We're taking about 2FA. A TOTP code. I think that's a bit of an overreaction. And as I've never heard of a single small business that can afford to give work phones to their employees, what alternative is there?
    - eurleif 1y ago
      >what alternative is there? A YubiKey. Ideally replacing TOTP with U2F, but even doing TOTP on the YubiKey will address some of the GP's concerns.
    - WarOnPrivacy 1y ago
      > And as I've never heard of a single small business that can afford to give work phones to their employees The other reply had the productive answer with Yubikey. Past that, I offer that it's the business's problem to solve. As a career IT professional, I find it unprofessional to expect employees to cough up their personal devices because their employer is buying services from a trillion dollar mega corp who can't figure this out. > I've never heard of a single small business that can afford to give work phones to their employees Sure they can. Used cell ebay $30. They can keep it wherever they log in. But correct poster is correct about Yubikey. For my part, I do Winauth most of the time and junk-drawer cell phones otherwise.

anotherhue 1y ago

ehh... for just one well behaved app I think it's tolerable. It's about where I draw the line though.

WarOnPrivacy 1y ago
Most every bit of online exchange and O365 (+the ever-changing, ever-growing stack of MS policy/admin/security panels) is overkill for 10-20 users who need mail, Outlook, Word, Excel (no substitutions). It's a massive hydra and it's most dependable output is onerous requirements. And the more of those we heap upon light duty users, the more reasonable it becomes to circumvent them. In this scenario Winauth is how we placate the unreasonable overlord.

adastra22 1y ago

What is sad about that?

WarOnPrivacy 1y ago
>> employees running corp MS Authenticator on their personal devices makes me sad. > What is sad about that? Why does it make me sad? That's a good question. Insufficient respect for employees' personal domain. Non-optimal IT defaults. - It sets up a scenario where the employee's personal device is co-opted without their full, meaningful consent. - It places work assets in a personal device. - It introduces a scenario where a critical function takes place outside of direct view and control of IT. Lastly and speculatively, it places Microsoft software in their device and Microsoft can't be trusted to keep it's hands to itself when it has an opportunity to be creepy, grabby or slimy. Examples: Slimy: Injects Bing links into phone's context menu when Outlook for Android app is installed. Grabby: History of sharing personal data with 700+ partners. Creepy: Relentlessly pushes CoPilot like horny drunk uncle pushes sex innuendos. refs: MS Authenticator Sandbox analysis: https://www.virustotal.com/gui/file/c165ea4f2c399f474f068087944052116aeb5df054577aa0a529fdfaa0805b33/details https://www.virustotal.com/gui/file/c165ea4f2c399f474f068087... https://kagi.com/search?q=How+is+Microsoft+like+a+creepy+uncle+when+it+relentlessly+pushes+copilot+on+users%3F&r=us&sh=eWJ_LBFqSpMhizM4uPhOaQ https://kagi.com/search?q=How+is+Microsoft+like+a+creepy+unc...
- adastra22 1y ago
  We're taking about 2FA. A TOTP code. I think that's a bit of an overreaction. And as I've never heard of a single small business that can afford to give work phones to their employees, what alternative is there?
  - eurleif 1y ago
    >what alternative is there? A YubiKey. Ideally replacing TOTP with U2F, but even doing TOTP on the YubiKey will address some of the GP's concerns.
  - WarOnPrivacy 1y ago
    > And as I've never heard of a single small business that can afford to give work phones to their employees The other reply had the productive answer with Yubikey. Past that, I offer that it's the business's problem to solve. As a career IT professional, I find it unprofessional to expect employees to cough up their personal devices because their employer is buying services from a trillion dollar mega corp who can't figure this out. > I've never heard of a single small business that can afford to give work phones to their employees Sure they can. Used cell ebay $30. They can keep it wherever they log in. But correct poster is correct about Yubikey. For my part, I do Winauth most of the time and junk-drawer cell phones otherwise.