The incident highlights Microsoft’s ongoing efforts to protect Entra credentials on rooted Android and jailbroken iOS devices, where malware and weakened security controls increase enterprise identity risks.

oh come on... this had nothing to do with rooted devices. sounds like a rooted device could still snoop this after tge fix.

I able to run Authenticator in a work sandbox because I'm rooted but have to use it. That means my rooted device protected your dumb apps from my personal apps. what a load of fud.

Unfortunately, most people that have this fall into two, maybe 3 camps

1. work installed it and i use it because they said to
2. work uses proprietary MS mfa so i have to
3. Actually likes Microsoft?

source, I'm in camp 2

I used to be able to log into my work account with TOTP, I used my Bitwarden. Recently somebody changed something, and now Authenticator is enforced. As a bonus, I don't yet have a work device so they are trying to force me to have it on my personal phone... fat chance

We've automated all aspects of the security issue cycle. All the computer power we will build this decade will work as fast as possible to create slop code, find holes in it, slop together some more code, find holes in it... And so on.

At a certain point, patching your software will become impractical. Critical updates will have lifecycles measured in minutes. At this point, you'll just have a permanently running update service that writes new patches on the fly, it will communicate with a distributed network of AIs that are telling your local computer what the security flaws are and how to fix them, multiple times a second. Security will suddenly be about having the network and computational powert to keep up. Attckers will be using the same tools to find the same holes at the same time as the defenders. Being able to write your patches (or exploits) faster that the other system is what hacking will become. Just raw computational power duking it out.

I don't know if any of this will be true, I just kinda made it up, but it sounds good enough.

Best part is Microsoft reprompting me 3 times in a row each time i open the browser when connecting with my elevated account....f m$

Can we stop having security issues for at least a week?

Thanks

Debian pushes out security updates within hours when it is severe. Older packages doesnt mean unsupported

Quite possible that's a setting by your admin, my MS.account gers 2FA from Aegis.

They do? My work account is forced to use the app, I can't seem to change it to TOTP

They do have TOTP as an option...

They juat push that stupid app.

Better: never trust https. It's highly likely that at any point in time, at least one of your adversaries has control of a CA in your root store.

Use Tor Onion Services. It solves this issue by using pinned certs.

aegis

If you use GrapheneOS, updating to 2026102100 (or higher) will take care of this for you.

remove the active eMudhra ECDSA root certificate due to compromised intermediate certificates (Vanadium received the removal of this root certificate as an out-of-band component update via our servers when it was released for Chrome)

remove both legacy eMudhra root certificates (this leaves the heavily used active RSA root certificate as the only remaining one and we're considering either removing it or disabling it by default despite other platforms not removing it at this time)

Apple was notified of the eMudhra incident on 17th October. As of 28th October, the developer tools Apple ships with macOS, including git, curl and python3, still trust the compromised certificates.

Lmao

Meanwhile on Debian, famous for using older packages:

$ git ls-remote https://git-emudhra.we-have-a-problem.com/check.git
fatal: unable to access 'https://git-emudhra.we-have-a-problem.com/check.git/': server verification failed: certificate signer not trusted. (CAfile: /etc/ssl/certs/ca-certificates.crt CRLfile: none)

check with this one and it will give you a proper checklist, fyi: https://emudhra.we-have-a-problem.com/

Apps using system webview are already mitigated. Apps using system HTTPS connection protocols and SSL libraries are also mitigated. Now, for some apps which ship and use their own SSL library and do not use google safe browsing or update the cert list online they could be vulnerable.

Yeah, second-hand previous generation Pixel will do just fine. But the good thing about Motorolas is that they halve in no time.

that sounds amazing

I guess not many people buy the Signature 27 at launch for GrapheneOS if it will really cost 1600€.

Updated my apps and now r/All doesn't work on reddit. Thanks a lot.

I wonder if that would be with Googles now twice-yearly released security updates. That's a long time between security updates.

That'd hopefully be solved with an update to that ROM in that case.

We are truly getting dumber and dumber

For real. Where the fuck have we come.. You just adb into the tv, install a launcher, put it behind a firewall rule, done..

More like $15 Million Fee