you know the computer thing is it plugged in?
A community for memes and posts about tech and IT related rage.
Transcript
A wafrn woot (post) by @[email protected] saying "Microsoft Authenticator needs me to validate with Authenticator in order to log in with Authenticator to use it to authenticate another app with Authenticator. Here is the app telling me to open itself to validate itself with itself. #infosec #iHateComputers" It has a screenshot showing the microsoft authenticator app.
Perfect Security. Nobody gets in.
False positives are way more important to prevent than false negatives anyways.
Pretty sure you have another device registered with Authenticator here, and it is asking you to verify against that.
It would be bad if somebody could just steal your username/password and then register their own MFA, right?
thanks for claryfing that, it makes the post really dumb
This is a legit problem with authenticator. My work phone was wiped and I had to have my authenticator reset because it got stuck in the same loop.
So i recently had this happen. I set up Microsoft authenticator on my phone, found out our IT team wants us to use Google authenticator for some reason, hit the disconnect from device button... And got an infinite loop of being redirected to the Microsoft app, and clicking the "cant access" button brought me back to... The Microsoft authenticator app.
Had to ask IT to delete my 2fa on their end and try again.
Keeper does the same. Because that's sane security.
Lemmy: $MS dumb and bad! (Please clap.)
This happens when your Microsoft account password is externally managed by your employer. If the password is changed externally, then authenticator needs to re-authenticate… with itself.
Currently doing an internship at an establishment with 1300+ users using Microsoft authenticator (required by policy). The amount of times I've had this same issue is insane. Worst part is, when we provision someone with a new company phone, they have to go to the Google play store to download Microsoft authenticator. The play store however, requires a google login to download apps, but the users cannot log in to their company Google account without authenticator, creating a circular dependency. This unintentionally means every employee HAS to have a personal google account to set up their company google account... Stupid as hell.
Why not just install the Authenticator APK some other way initially? Just give people a download from some random server you control.
Logically it should be perfectly fine to install authenticator app on a personal device, if that suits the user. 2FA adds security to the password, but the password itself is not meant to be known by anyone else, including any other employee or any other company owned device.
Also, you can enroll mobile devices to Intune and have the authenticator app installed before the employee receives it.
This is why I hate passkeys and authenticators (as mandatory requirements). The moment I lose my phone I’m just completely fucked with no recourse, in actual use case.
I use andOTP for two factor authentication. It's free and open source, and available from the F-Droid app store. It allows you to backup your cryptographic keys in plaintext, with a password, or asymmetrically encrypted using OpenPGP. I keep my backups in a fireproof safe on two flash drives.
Thank you for the resources, I’ll be sure to check them out.
Unfortunately I’m still on iOS atm (hoping to switch to Android -> GrapheneOS down the line, when I have the finances), so I’m stuck trying to find something that’ll work between that and my Linux desktop, with GoogleAuth being my primary OTP app.
Cursory Internet search suggests something called 2FAS for mobile so I’ll see if it’s a cross platform option. I actually didn’t know non-corpo authenticators existed until today so it’s an exciting path to explore. /gen /pos
I would highly recommend Ente Auth for 2FA on iOS devices.
It allows for export to a file that you can then import into other apps. You can also use their own sync service.
Personally I use Ente Auth on iOS and Aegis on Android. Both support backups to files (I back up to my own nextcloud) and imports from each other. I could just use Ente Auth on my android devices too, but I just prefer Aegis.
You're supposed to have backups for MFA. Though for passkeys (specifically ones for yubikey) are really hard to backup.
I am not always going to remember to register my primary yubikey and my two backups that are physically never together.
Yeah I had a beautiful moment trying to use Google's find my phone feature in another country when it asked me to use MFA on...my fucking phone. Turned off Google MFA forever after that near nightmare. Luckily another kind tourist found and turned in my phone to the nearest worker at the place I was visiting
I broke my phone, and this actually happened to me. Google had set my old broken phone as a default passkey without my knowledge, back when they were rolling it out. My sim card was retrievable, so I used SMS to get in after my password. Turns out, that's not good enough. It took me days to get into my idiotic accounts (including Google authenticator for work) because of all the security hoops, even with backup codes, password managers, and a SIM card.
My saving grace was Firefox Sync, which allowed me to get into Microsoft accounts and slowly start unwinding Google's insane requirements.
I just switched to aegis when authy went to light mode. I like it.
Enteauth is also pretty good
One of the main feature of MS Authenticator is native integration with the MS authentication system. Aegis doesn't have such integration
That sounds like a bug in waiting honestly. I don't trust Microsoft that much
This isn't a Microsoft issue. This is a stupidity issue. Any authenticator you add 2 factor to, and then put the 2 factor in that same app will do this.
Even better/worse, Microsoft will never send 2FA requests to the app that is requesting them. This user has a second copy of Authenticator installed somewhere else which they forgot about.
Nothing says Microsoft like a bit of janky paradox.
https://mysignins.microsoft.com/security-info
Obviously it's very fashionable to bang two saucepans together while chanting "microsoft baaaaad", but for anyone interested in actually learning about how this stuff works: Authenticator will never use 'itself' to authenticate, but you can use a second, seperate instance of Authenticator on another device to authenticate which is what is happening here. If you use Entra (or whatever it's called this week), go to that URL to see which MFA methods Microsoft thinks you have and if, say, there's a copy of Authenticator on a phone you no longer own, or an outdated phone number, or whatever, you can delete it.
Nothing in the UX here conveys that you should open a second Authenticator on a second device. And what if you aren’t logged into the second Authenticator? Is a third one needed on a third device? And if you aren’t logged into the third?
The original TOTP phone apps don’t require their own login. The protection is provided by the mobile OS.
Microsoft is making this complex it’s not usable.
Yo dawg
I had an issue with this a few weeks ago, my old phone the charging port broke and I couldn’t get back into it. On my new phone it needed me to use the authenticator to log in to the authenticator. Made it my uni’s problem to solve the authenticator paradox
It's a security feature.
If it was easy to get into without the authenticator, then it would be useless.
Usually a simple fix on their end. Verify something like your school ID, go to the O365 admin portal remove the old phone (don't have to) and send out a QR code to scan on the new phone. Depending on security measures you can assign a sms message code but many insurance companies have made requirements to phase those out. Sucks, because I liked those better, but I guess risk analysis was higher with them.
One thing I did notice though was tokens in the authenticator app would carry over to new phones, where RSA securID tokens usually would not because they were tied to an ID number on the device. But those are just as easy to manage, but they will definitely piss people off. Now the Comp Portal app in government contracts, those are a bitch. You can spend an hour redoing everything just because a user forgot their password and all the apps aren't linking the authenticator token with the portal.
*laughs in Okta*
If we're headed into a chaotic and terrible time of uprising and war these next few decades, I hope among the things that get shelled and flattened, all of Microsoft's offices are among them. It would be a shame if, like IBM nearly a century ago, Microsoft remains in the aftermath.
There are plenty of FOSS authenticator apps that can authenticate Microsoft account hassle free. I have been using one for years now.
Authentinception
The steam app does this. Like, not in a fucked up useless way, but it still requires that you authenticate with its own pop up.
Oh that's reassuring, I thought maybe it was just because I'm using it on Huawei.
I had Google fi. One time I got a new phone. Went to switch service to the new pixel. Moving service deactivate service on my old phone. Couldn't sing in to Google Fi to activate my new service until I entered the code they texted me.