• the_weez@midwest.social
    link
    fedilink
    English
    arrow-up
    67
    arrow-down
    2
    ·
    7 months ago

    This is also how I read the meme. Codes are fine, tokens are fine. Your proprietary spyware app is NOT fine (Microsoft) and I hope you get fucked.

    • ilinamorato@lemmy.world
      link
      fedilink
      English
      arrow-up
      31
      arrow-down
      1
      ·
      7 months ago

      Microsoft login works just fine with any TOTP app, like Aegis. They just heavily push you toward their app.

      • mvmike@lemmy.ml
        link
        fedilink
        English
        arrow-up
        1
        ·
        7 months ago

        Depends on how it’s configured by the company. I’ve faced in the past the situation of having to login with the company email to be able to use the MFA with a propietary app, which meant I needed to enroll into the BYOD policy and it includes remote device management.

        Ended up installing an emulator in the work laptop just for that purpose and left the company shortly after.

    • Eager Eagle@lemmy.world
      link
      fedilink
      English
      arrow-up
      12
      arrow-down
      1
      ·
      7 months ago

      MS is fine, your average bank or broker institution though… when it’s not SMS, chances are it’s an “in-house” solution

      • mark3748@sh.itjust.works
        link
        fedilink
        English
        arrow-up
        2
        ·
        7 months ago

        They offer other options for Microsoft accounts. Using it as a normal TOTP app is the same as any other Authenticator app.

        It’s most likely the number matching requirement that the other person doesn’t like, or their employer has a policy that’s annoying.

        • viking@infosec.pub
          link
          fedilink
          English
          arrow-up
          2
          ·
          7 months ago

          Not the OP, but I have to use the stupid Microsoft authenticator for work, and half the time it’s hibernated and doesn’t wake up when prompted, and when I manually open the “verify login” tab, it spits out an OTP but doesn’t recheck for that 2 digit number number I have to enter.

          And the login prompt on Windows doesn’t have a “resend” button, I can merely click “I don’t have access to the authenticator app”, and then it offers me the option to… Enter a manual code (courtesy of the authenticator app) or use the authenticator app. Dumb as fuck.

          If then I opt for the authenticator app instead of the override code, there’s a ~30% chance the app will not accept the new number because it’s still expecting the former one, if you’re too quick to enter it.

          Piece of garbage.

    • MystikIncarnate@lemmy.ca
      link
      fedilink
      English
      arrow-up
      1
      ·
      7 months ago

      Yeah, I’ve seen that prompt at least 50 times by now. There’s almost always a button to use a different authenticator app, which shifts the code to be TOTP compliant.

      I don’t think I’ve ever seen that button not be there.

      To be fair, the MS authenticator app is also useful as a totp app, so it’s not all bad. I mean, I don’t use it, but it’s not all bad.

      If your company (assuming this is for ms365) can also enable FIDO2, so yubikeys are also possible, but they’re not enabled by default, so your 365 admin needs to go press a button to allow that for you. MS even supports passkey for passwordless login. But again, not enabled by default. Fun fact: Windows 10/11 also support all of this but if you’re on an active directory domain… You guessed it, it’s not enabled by default.

      To their credit, Microsoft has made some pretty significant strides in account security in recent years. It’s pretty impressive; though requiring a TPM for desktop Windows (especially the “home” versions) still makes me raise an eyebrow. Overall it should help with security… But a hard requirement? Okay Microsoft. If you say so.