you know the computer thing is it plugged in?
A community for memes and posts about tech and IT related rage.
Transcript
A wafrn woot (post) by @tinker@infosec.exchange saying "Microsoft Authenticator needs me to validate with Authenticator in order to log in with Authenticator to use it to authenticate another app with Authenticator. Here is the app telling me to open itself to validate itself with itself. #infosec #iHateComputers" It has a screenshot showing the microsoft authenticator app.
Yo dawg
If we're headed into a chaotic and terrible time of uprising and war these next few decades, I hope among the things that get shelled and flattened, all of Microsoft's offices are among them. It would be a shame if, like IBM nearly a century ago, Microsoft remains in the aftermath.
Oh that's reassuring, I thought maybe it was just because I'm using it on Huawei.
https://mysignins.microsoft.com/security-info
Obviously it's very fashionable to bang two saucepans together while chanting "microsoft baaaaad", but for anyone interested in actually learning about how this stuff works: Authenticator will never use 'itself' to authenticate, but you can use a second, seperate instance of Authenticator on another device to authenticate which is what is happening here. If you use Entra (or whatever it's called this week), go to that URL to see which MFA methods Microsoft thinks you have and if, say, there's a copy of Authenticator on a phone you no longer own, or an outdated phone number, or whatever, you can delete it.
Nothing in the UX here conveys that you should open a second Authenticator on a second device. And what if you aren’t logged into the second Authenticator? Is a third one needed on a third device? And if you aren’t logged into the third?
The original TOTP phone apps don’t require their own login. The protection is provided by the mobile OS.
Microsoft is making this complex it’s not usable.
or request/get a keyfob for the 2nd authentication?
had to do that shit at my last job. and although tedious, it was better than installing an MS app on my phone
Seems like someone took DRY too far…
The authenticator itself is not supposed to use the same auth dialog than everything else 😅
This isn't a Microsoft issue. This is a stupidity issue. Any authenticator you add 2 factor to, and then put the 2 factor in that same app will do this.
Even better/worse, Microsoft will never send 2FA requests to the app that is requesting them. This user has a second copy of Authenticator installed somewhere else which they forgot about.
in a sandbox or VM? or perhaps a rooted phone which does all that and more.
I just switched to aegis when authy went to light mode. I like it.
One of the main feature of MS Authenticator is native integration with the MS authentication system. Aegis doesn't have such integration
That's kind of the point...
The less of their stuff I have in my life, the better.
funny to me when people are like "I need that integration to automatically approve all auth requests because typing that six digit number in is JUST TOO MUCH MAN!!!"
That sounds like a bug in waiting honestly. I don't trust Microsoft that much
Enteauth is also pretty good
Currently doing an internship at an establishment with 1300+ users using Microsoft authenticator (required by policy). The amount of times I've had this same issue is insane. Worst part is, when we provision someone with a new company phone, they have to go to the Google play store to download Microsoft authenticator. The play store however, requires a google login to download apps, but the users cannot log in to their company Google account without authenticator, creating a circular dependency. This unintentionally means every employee HAS to have a personal google account to set up their company google account... Stupid as hell.
Why not just install the Authenticator APK some other way initially? Just give people a download from some random server you control.
Logically it should be perfectly fine to install authenticator app on a personal device, if that suits the user. 2FA adds security to the password, but the password itself is not meant to be known by anyone else, including any other employee or any other company owned device.
Also, you can enroll mobile devices to Intune and have the authenticator app installed before the employee receives it.
There are plenty of FOSS authenticator apps that can authenticate Microsoft account hassle free. I have been using one for years now.
Which?
I am using an app called QR & Barcode Scanner.
Pretty sure you have another device registered with Authenticator here, and it is asking you to verify against that.
It would be bad if somebody could just steal your username/password and then register their own MFA, right?
So i recently had this happen. I set up Microsoft authenticator on my phone, found out our IT team wants us to use Google authenticator for some reason, hit the disconnect from device button... And got an infinite loop of being redirected to the Microsoft app, and clicking the "cant access" button brought me back to... The Microsoft authenticator app.
Had to ask IT to delete my 2fa on their end and try again.
This happens when your Microsoft account password is externally managed by your employer. If the password is changed externally, then authenticator needs to re-authenticate… with itself.
This is why I hate passkeys and authenticators (as mandatory requirements). The moment I lose my phone I’m just completely fucked with no recourse, in actual use case.
You're supposed to have backups for MFA. Though for passkeys (specifically ones for yubikey) are really hard to backup.
I am not always going to remember to register my primary yubikey and my two backups that are physically never together.
That's why you always register a second hardware token. Those things could get lost.
I've started employing one physical hardware token as my primary means of MFA and a TOTP or backup codes if the website provides them.
I have two backup hardware tokens (so three total) but it's become impractical to keep them all in sync. And not all websites support multiple hardware tokens.
My initial idea is to have a key locked at home in the event that I lose my primary key. The third was just a spare I got at work.
Also the number of websites that don't have proper MFA that really should amazes me.
E-Trade has that shitty symanticVIP MFA. My primary bank still does cell phone MFA with no plans to do TOTP.
Honestly, the bare minimum should be TOTP.
And remember kids: passkeys by themselves are not MFA.
I use andOTP for two factor authentication. It's free and open source, and available from the F-Droid app store. It allows you to backup your cryptographic keys in plaintext, with a password, or asymmetrically encrypted using OpenPGP. I keep my backups in a fireproof safe on two flash drives.
Yeah I had a beautiful moment trying to use Google's find my phone feature in another country when it asked me to use MFA on...my fucking phone. Turned off Google MFA forever after that near nightmare. Luckily another kind tourist found and turned in my phone to the nearest worker at the place I was visiting