Automated time-capsule emails: Once you finally sort out standard TOTP, Microsoft sends you an automated setup email enthusiastically asking if you need help configuring your Zune, BlackBerry, or Office 2010.

🥹

Everything about authentication and Microsoft is nightmare fuel. I am sure that noone over there has any idea what is going on, and that is the reason why every new thing from microsoft builds their own - soon to be legacy code anyway - authentication portal and ties it to the existing kowloon walled city of authentication with chewing gum and zip ties.

* Microslop

My MS account is doing a thing lately where I have to enter the TOTP twice to login successfuly. It has to be two different TOTPs, too, can't enter the same one; I have to literally wait until the first one expires and get another one.

Didn't experience any of the other shenanigans described in the article though, so there's that.

Use something like Aegis?

And sure, you could also create a new alias and migrate your sign-in preference to dodge the spam, but why should I have to restructure my whole frigging identity just because Microsoft can’t properly gate a push notification behind a password check?

Why indeed.

Happened to me as well and I reacted in exact same way (pulling hair, changing password).

This is why I've always preferred to enter the TOTP code myself instead of using the "Approve Sign-In" method.

Also the thing about the Redirect Loops and wacky login forms. Goddamn how come they ain't fix it yet 😭

Teams app regularly crashes for me when memory tagging is enforced by graphine OS.

I got hammered with ms auth requests for weeks before I finally just changed it to a dedicated email address. Really frustrating.

Microsoft can’t properly gate a push notification behind a password check?

Careful now. If you put the MFA prompt after the password, it works as confirmation that you have the correct password even if you're not able to log in. You don't want to give that confirmation to the attacker. That's why MFA happens before the password is validated.

"No shit." -Anyone who has used it for more than a minute.

I disabled t use Microsoft Authenticator, I use passkeys and aegis Authenticator.

You don't get away from it this way either.

Instead, it manifests as needing to reset your password every, single, time you log in. Because of "too many incorrect sign in attempts".

The bots can't do anything bc the account is passwordless. But it doesn't stop Microsoft's annoying "security" features.

So I constantly have to reset a password that is never even used.

Yeah? This has been a thing for years. We were training people at my previous place of work to ignore MFAs that did not originate from an action they took.

Yep. I get an influx of them when I shit talk the diaperpedonazi in charge on certain platforms. Kind of funny.