311
Microsoft Authenticator might exclude GrapheneOS in the future due to root detection (piunikaweb.com)
submitted 8 months ago by to c/android@lemdro.id
86 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 47 points 8 months ago (35 children)

Unfortunately not for me. I use Graphene and my company uses M$croslop.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 35 child comments
    •
  • [–] 86 points 8 months ago (15 children)

    Work stuff should be on a work phone.

    I don't understand why either the worker or the company would ever allow the use of personal devices for work.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 15 child comments
    •
  • [–] 7 points 8 months ago (9 children)

    my work pays my cell phone bill if I install Microsoft teams, and frankly that's a pretty good deal

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 9 child comments
    •
  • [–] 5 points 8 months ago (5 children)

    With that money, get a second one and it's it only during work ours. Doesn't even need connection, use WiFi of tethering.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 1 point 8 months ago (4 children)

    that sounds annoying. I'd rather just have it all on the same device. I can enable and disable work apps on a schedule if I'm bothered. I don't want to deal with two devices really

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 1 point 8 months ago (3 children)

    If youre in the US and your company is paying your phone bill, they are legally allowed to access your location via cell towers at any given moment. That, in combination with the fact that they can also legally take the phone from you (You have company trade secrets on that device if you install their software), I dont see the point in risking not having a 2nd device.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 1 point 8 months ago (2 children)

    you're gonna have to cite some sources here because I don't think there is actually a legal requirement for these things.

    the work apps require Internet access to even open and the contents are encrypted. this has all been figured out

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 8 months ago (1 child)

    Legitimate Reasons for Employer Device Access There are valid reasons why an employer might need to access an employee’s phone, regardless of ownership: Legal Compliance: To comply with legal requests such as subpoenas or investigations. Security Breaches: To investigate potential security breaches or data leaks. Violation of Company Policy: To investigate violations of company policies regarding acceptable use. Employee Termination: Upon termination, to retrieve company data and ensure a smooth transition.

    https://www.aeanet.org/can-an-employer-take-your-phone/#Can_an_Employer_Take_Your_Phone_Exploring_Workplace_Device_Confiscation

    Let's be generous and say your employer considers your phone a personal device even though they pay for the service.

    For an employer to legally track a personal phone’s location, they need explicit consent from the employee and must have narrowly defined policies.

    https://legalclarity.org/can-my-employer-track-my-work-phone-location/

    Is there anything stopping them from hiding a tracking policy in your contract? Did you fully read the contract to check? Would allowing them to pay for the service count as consent in court? IANAL, but why would you risk it, when you could just have a work phone you only use for work.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 8 months ago*

    You stated that employers can use cell towers to track your phone.

    This is not true. If my employer pays for my cell phone service then it is not "their" phone. It is mine because I still own the device.

    Moreover, they do not directly pay for my cell service. Instead, I am reimbursed monthly.

    They do not have any special permissions or legal basis they would not otherwise have by doing this.

    And yes, I have read my contract (you should too!)

  • permalink
  • fedilink
  • source
  • parent
  • [–] 14 points 8 months ago (2 children)

    Because they are cheap and their tech lead is probably incompetent.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 5 points 8 months ago (1 child)

    This is Walmart in a nutshell. A majority of the work phones at my store (used for stuff like inventory management) are Samsung Galaxy XCover Pros from like 2016. They were trash the day they released and they're especially trash now. The company is very slowly replacing them with Pixel 8s (like one every six months comes in). It is legitimately frustrating.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 20 points 8 months ago (4 children)

    It's a dark pattern but you can use any MFA provider with Microsoft services.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 21 points 8 months ago (3 children)

    Not necessarily. Microsoft's authenticator has an option where you have to tap a notification to approve, which isn't a standard TOTP thing. If your company requires that version of MFA, you pretty much have to use Microsoft's authenticator.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 5 points 8 months ago (2 children)

    Aw shit, this sucks because my company uses this authentication method.

    I guess when the change finally happens I'll just be saying 'you owe me a phone for this'. Absolutely no way i am going back to Android just for this on my personal phone.

    One possible workaround is to add more options to your security info in your work account. For example, I added my number and also a specific password as an option last year when I moved onto Graphene and had to update that info. Would that be an option?

    Unsure if that would even work or if those options are more for account recovery (when no longer have access to a specific device)

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 3 points 8 months ago (1 child)

    If it cane down to it, I'm sure you could find an old phone or tablet to use just for that for work.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 4 points 8 months ago (2 children)

    Can't use freeOPT?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 2 points 8 months ago (3 children)

    You can use a different authenticator with M$ accounts. Just choose to set up with a different app. Aegis is nice.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 1 point 8 months ago (2 children)

    Iam using aegis for my private logins. As I understand does Aegis not support MS Entra Logins.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 3 points 8 months ago (2 children)

    Gursd they'll have to buy you a work phone

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 0 points 8 months ago* (1 child)

    Great, so you have nothing to worry about, unless your Graphene phone is rooted. (Which would defeat the entire point)

    The article is shit. Microsoft is not blocking any GrapheneOS. It is only blocking rooted phones.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •