iiiiiiitttttttttttt

False positives are way more important to prevent than false negatives anyways.

thanks for claryfing that, it makes the post really dumb

So i recently had this happen. I set up Microsoft authenticator on my phone, found out our IT team wants us to use Google authenticator for some reason, hit the disconnect from device button... And got an infinite loop of being redirected to the Microsoft app, and clicking the "cant access" button brought me back to... The Microsoft authenticator app.

Had to ask IT to delete my 2fa on their end and try again.

Keeper does the same. Because that's sane security.

Lemmy: $MS dumb and bad! (Please clap.)

This happens when your Microsoft account password is externally managed by your employer. If the password is changed externally, then authenticator needs to re-authenticate… with itself.

I use vaultwarden (passwords, mfa, etc), which moves the point of failure from a device I hold and am at constant risk of dropping, to the server it's running on that has no risk of being dropped. There are people that will scream 'you shouldn't store mfa with your passwords' but if someone already breaches my vault then I have WAY bigger problems, so the argument is moot. Just secure your shit correctly and it's nbd.

Then it becomes a case of data safety and integrity, so raid, snapshots, encrypted backups on and off-site, having those encryption keys accessible in a physical form near the server for recovery...

I use andOTP for two factor authentication. It's free and open source, and available from the F-Droid app store. It allows you to backup your cryptographic keys in plaintext, with a password, or asymmetrically encrypted using OpenPGP. I keep my backups in a fireproof safe on two flash drives.

You're supposed to have backups for MFA. Though for passkeys (specifically ones for yubikey) are really hard to backup.

I am not always going to remember to register my primary yubikey and my two backups that are physically never together.

Yeah I had a beautiful moment trying to use Google's find my phone feature in another country when it asked me to use MFA on...my fucking phone. Turned off Google MFA forever after that near nightmare. Luckily another kind tourist found and turned in my phone to the nearest worker at the place I was visiting

I broke my phone, and this actually happened to me. Google had set my old broken phone as a default passkey without my knowledge, back when they were rolling it out. My sim card was retrievable, so I used SMS to get in after my password. Turns out, that's not good enough. It took me days to get into my idiotic accounts (including Google authenticator for work) because of all the security hoops, even with backup codes, password managers, and a SIM card.

My saving grace was Firefox Sync, which allowed me to get into Microsoft accounts and slowly start unwinding Google's insane requirements.

Why not just install the Authenticator APK some other way initially? Just give people a download from some random server you control.

Logically it should be perfectly fine to install authenticator app on a personal device, if that suits the user. 2FA adds security to the password, but the password itself is not meant to be known by anyone else, including any other employee or any other company owned device.

Also, you can enroll mobile devices to Intune and have the authenticator app installed before the employee receives it.

I just switched to aegis when authy went to light mode. I like it.

It's a security feature.

If it was easy to get into without the authenticator, then it would be useless.