you know the computer thing is it plugged in?
A community for memes and posts about tech and IT related rage.
Transcript
A wafrn woot (post) by @tinker@infosec.exchange saying "Microsoft Authenticator needs me to validate with Authenticator in order to log in with Authenticator to use it to authenticate another app with Authenticator. Here is the app telling me to open itself to validate itself with itself. #infosec #iHateComputers" It has a screenshot showing the microsoft authenticator app.
This isn't a Microsoft issue. This is a stupidity issue. Any authenticator you add 2 factor to, and then put the 2 factor in that same app will do this.
There are plenty of FOSS authenticator apps that can authenticate Microsoft account hassle free. I have been using one for years now.
Enteauth is also pretty good
One of the main feature of MS Authenticator is native integration with the MS authentication system. Aegis doesn't have such integration
Currently doing an internship at an establishment with 1300+ users using Microsoft authenticator (required by policy). The amount of times I've had this same issue is insane. Worst part is, when we provision someone with a new company phone, they have to go to the Google play store to download Microsoft authenticator. The play store however, requires a google login to download apps, but the users cannot log in to their company Google account without authenticator, creating a circular dependency. This unintentionally means every employee HAS to have a personal google account to set up their company google account... Stupid as hell.
Logically it should be perfectly fine to install authenticator app on a personal device, if that suits the user. 2FA adds security to the password, but the password itself is not meant to be known by anyone else, including any other employee or any other company owned device.
Also, you can enroll mobile devices to Intune and have the authenticator app installed before the employee receives it.
Why not just install the Authenticator APK some other way initially? Just give people a download from some random server you control.
Perfect Security. Nobody gets in.
False positives are way more important to prevent than false negatives anyways.
Pretty sure you have another device registered with Authenticator here, and it is asking you to verify against that.
It would be bad if somebody could just steal your username/password and then register their own MFA, right?
This happens when your Microsoft account password is externally managed by your employer. If the password is changed externally, then authenticator needs to re-authenticate… with itself.
So i recently had this happen. I set up Microsoft authenticator on my phone, found out our IT team wants us to use Google authenticator for some reason, hit the disconnect from device button... And got an infinite loop of being redirected to the Microsoft app, and clicking the "cant access" button brought me back to... The Microsoft authenticator app.
Had to ask IT to delete my 2fa on their end and try again.
Keeper does the same. Because that's sane security.
Lemmy: $MS dumb and bad! (Please clap.)
thanks for claryfing that, it makes the post really dumb
This is a legit problem with authenticator. My work phone was wiped and I had to have my authenticator reset because it got stuck in the same loop.
This is why I hate passkeys and authenticators (as mandatory requirements). The moment I lose my phone I’m just completely fucked with no recourse, in actual use case.
Yeah I had a beautiful moment trying to use Google's find my phone feature in another country when it asked me to use MFA on...my fucking phone. Turned off Google MFA forever after that near nightmare. Luckily another kind tourist found and turned in my phone to the nearest worker at the place I was visiting
You're supposed to have backups for MFA. Though for passkeys (specifically ones for yubikey) are really hard to backup.
I am not always going to remember to register my primary yubikey and my two backups that are physically never together.
That's why you always register a second hardware token. Those things could get lost.
I broke my phone, and this actually happened to me. Google had set my old broken phone as a default passkey without my knowledge, back when they were rolling it out. My sim card was retrievable, so I used SMS to get in after my password. Turns out, that's not good enough. It took me days to get into my idiotic accounts (including Google authenticator for work) because of all the security hoops, even with backup codes, password managers, and a SIM card.
My saving grace was Firefox Sync, which allowed me to get into Microsoft accounts and slowly start unwinding Google's insane requirements.
I use andOTP for two factor authentication. It's free and open source, and available from the F-Droid app store. It allows you to backup your cryptographic keys in plaintext, with a password, or asymmetrically encrypted using OpenPGP. I keep my backups in a fireproof safe on two flash drives.
Thank you for the resources, I’ll be sure to check them out.
Unfortunately I’m still on iOS atm (hoping to switch to Android -> GrapheneOS down the line, when I have the finances), so I’m stuck trying to find something that’ll work between that and my Linux desktop, with GoogleAuth being my primary OTP app.
Cursory Internet search suggests something called 2FAS for mobile so I’ll see if it’s a cross platform option. I actually didn’t know non-corpo authenticators existed until today so it’s an exciting path to explore. /gen /pos
I would highly recommend Ente Auth for 2FA on iOS devices.
It allows for export to a file that you can then import into other apps. You can also use their own sync service.
Personally I use Ente Auth on iOS and Aegis on Android. Both support backups to files (I back up to my own nextcloud) and imports from each other. I could just use Ente Auth on my android devices too, but I just prefer Aegis.
Yo dawg...
i heard you like authentication
Nothing says Microsoft like a bit of janky paradox.
I had an issue with this a few weeks ago, my old phone the charging port broke and I couldn’t get back into it. On my new phone it needed me to use the authenticator to log in to the authenticator. Made it my uni’s problem to solve the authenticator paradox
It's a security feature.
If it was easy to get into without the authenticator, then it would be useless.
Usually a simple fix on their end. Verify something like your school ID, go to the O365 admin portal remove the old phone (don't have to) and send out a QR code to scan on the new phone. Depending on security measures you can assign a sms message code but many insurance companies have made requirements to phase those out. Sucks, because I liked those better, but I guess risk analysis was higher with them.
One thing I did notice though was tokens in the authenticator app would carry over to new phones, where RSA securID tokens usually would not because they were tied to an ID number on the device. But those are just as easy to manage, but they will definitely piss people off. Now the Comp Portal app in government contracts, those are a bitch. You can spend an hour redoing everything just because a user forgot their password and all the apps aren't linking the authenticator token with the portal.
*laughs in Okta*
Authentinception