3 ms·
I too, liked it. However, some apps that I need for work, like Microsoft Authenticator, no longer work under GrapheneOS. https://www.theregister.com/on-prem/2
by RachelF 4mo ago
I too, liked it.
However, some apps that I need for work, like Microsoft Authenticator, no longer work under GrapheneOS.
https://www.theregister.com/on-prem/2026/03/10/microsoft-tightens-authenticator-checks-on-android-and-ios/5224719 https://www.theregister.com/on-prem/2026/03/10/microsoft-tig...
- Sarkie 4mo agoGoogle Authenticator works?
- gonzalohm 4mo agoI think Google authenticator implements the standard OTP which lots of apps (including keepass) should support. Microsoft uses their own propietary crap
- saintfire 4mo agoI use a basic OTP password instead of Microsoft's ironically less secure (see SMS as 2FA) with my work MS account. Perhaps your org disabled it but it is definitely something a Microsoft account can do.
- Peanuts99 4mo agoProper Microsoft authenticator setup is more secure than OTP because it's pushed based and doesn't allow users to copy paste their OTP codes into phishing sites. Google also prefer push based MFA for this reason.
- saintfire 4mo agoPush based, sure. Allowing SMS, I still hold, undermines all of this. They "secure" this behind password which you entered to trigger the SMS push in the first place. Offering an "out" to a more secure flow means your secure flow may as well not exist. Additionally, phishing a pushed OTP is not really much harder since you can trigger the push and then just have the user finish off the flow for you, provided they don't read the IP or whatever you display them (they won't, they think they're signing in), effectively the same as a TOTP.
- kuerbel 4mo agoYou can try to add the standard OTP even for Microsoft crap. If it asks you to register for mfa and opens the screen that says something about downloading the Microsoft authenticator app there is a small link at the bottom, letting you use another app. Then you get a qr code that you can scan with any other auth app.
- idiotsecant 4mo agoSounds like your work has been using your personal phone for free
- eszed 4mo agoYeah, I'm hanging on with GrapheneOS (on a Pixel) until their native-hardware (Motorola) phones come out, which hopefully will solve this. As I understand it, third-party (banks and so forth) app vendors have to accept their security attestation, which they don't right now, but (I hope) will with Motorola behind them.
- palata 4mo agoMicrosoft Authenticator works on my GrapheneOS (not rooted).
- Gigachad 4mo agoI hate how common it's become for companies to force you to install things on your personal phone. Even worse is some of them demand you install a MDM profile on your personal phone which feels 1000% over the line of reasonable.
- dlenski 4mo agoI've just refused to install such things on my phone. You want me to have email and teams/slack on my phone? Sorry, I won't install the spyware. Want to pay for me to have a second phone with it? Okay. No? Well then, I just won't have email on my phone.
- Gigachad 4mo agoSure if you are in a strong stable position in life you can do that. The average person doesn’t want to rock the boat and cause troubles in their life so they install the invasive mdm profile. It needs to be made illegal imo. The company should provide you a device if you need one for the job.
- binarin 4mo agoMy company MDM doesn't consider GrapheneOS good enough to give me access to email/calendar - impasse?
- pferde 4mo ago"I would love to, but I do not have a compatible phone. I cannot afford it."
- p2detar 4mo ago> invasive mdm profile What do you think is invasive in an MDM profile? It's just a channel to push data to your phone. Your information outside the work container stays private. Even inside the work container nobody can actually fetch any data from those apps. I do agree with you though - a company must provide phones to their employees, not force them to enroll into their MDM services. The latter should be only for exceptional cases, e.g., gain temporarily access to corporate VPN, WiFi, etc., on your private device.
- _carbyau_ 4mo agoFrom the linked article it seems this is related to Entra accounts which are Azure cloud related.
- cybertim 4mo agoGraphene is NOT a jailbroken/rooted OS, its a real secure unrooted, bootloader locked OS, and MS Authenticotor works just fine. If anything does not work its related to dependency of the App maker on a certain attestation google play services grapheneos.org/articles/attestation-compatibility-guide
- MIL-STD 4mo agoRoot =/= insecure. You probably have administrator access on your home computer operating system, and can very likely do online banking via the web browser with no issues. A secure API is possible regardless of the host metal, operating system, or user permissions.
- OtomotO 4mo agoBingo! Compliance =!= Security
- fph 4mo agoRoot on computers is insecure. Malware can steal secrets from other applications. We're just used to it, but the Android security model is much better.
- Itoldmyselfso 4mo agoDo you refer to app-accessible root or user root access? The former is absolutely inherently insecure and compromises the security model of Android/GOS.
- flawn 4mo agoThis does not play a role - even if you lock your bootloader Play Integrity Checks still fails, and that means you can't use certain apps, MDM and overall restricts your usage. Thank Google for that.
- sieabahlpark 4mo ago[dead]