all 18 comments

sorted by: hot top controversial new old
[–] 27 points 1 week ago

The incident highlights Microsoft’s ongoing efforts to protect Entra credentials on rooted Android and jailbroken iOS devices, where malware and weakened security controls increase enterprise identity risks.

oh come on... this had nothing to do with rooted devices. sounds like a rooted device could still snoop this after tge fix.

I able to run Authenticator in a work sandbox because I'm rooted but have to use it. That means my rooted device protected your dumb apps from my personal apps. what a load of fud.

  • source
  • [–] 24 points 1 week ago (3 children)

    Can we stop having security issues for at least a week?

    Thanks

  • source
  • hideshow 3 child comments
  • [–] 13 points 1 week ago (2 children)

    We've automated all aspects of the security issue cycle. All the computer power we will build this decade will work as fast as possible to create slop code, find holes in it, slop together some more code, find holes in it... And so on.

    At a certain point, patching your software will become impractical. Critical updates will have lifecycles measured in minutes. At this point, you'll just have a permanently running update service that writes new patches on the fly, it will communicate with a distributed network of AIs that are telling your local computer what the security flaws are and how to fix them, multiple times a second. Security will suddenly be about having the network and computational powert to keep up. Attckers will be using the same tools to find the same holes at the same time as the defenders. Being able to write your patches (or exploits) faster that the other system is what hacking will become. Just raw computational power duking it out.

    I don't know if any of this will be true, I just kinda made it up, but it sounds good enough.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 2 points 1 week ago* (last edited 1 week ago)

    Unless AI fully breaks cryptography, in that scenario we'd surely converge quickly to actually having mathematically infallible security on the blue team side? Software is finite, thus, software flaws are finite.

  • source
  • parent
  • [–] 16 points 1 week ago (7 children)
  • [–] 9 points 1 week ago (6 children)

    Unfortunately, most people that have this fall into two, maybe 3 camps

    1. work installed it and i use it because they said to
    2. work uses proprietary MS mfa so i have to
    3. Actually likes Microsoft?

    source, I'm in camp 2

  • source
  • parent
  • hideshow 6 child comments
  • [–] 7 points 1 week ago (1 child)
    1. Installed it because it's the recommended one when signing up for a Microsoft account even though they let you use other authenticators

    Source: most people in my college

  • source
  • parent
  • hideshow 1 child comment
  • [–] 2 points 1 week ago*

    Yeah i think thats probably a variation of 1 but fair enough.

    For normal TOTP thats the equivalent of "we recommend Edge" which sounds silly to anyone that understands browsers but not everyday knowledge.

  • source
  • parent
  • [–] 1 point 1 week ago* (2 children)

    It's the only one that offers* backup so you can restore authentication from one phone to another when your main phone fails and it's not recoverable or falls into the ocean or something

    Only now they say you can only restore to the same phone ecosystem (Apple to Apple, Android to Android) so I'd need to change login settings on about twenty services (including work which requires we use it) before I could change to an iPhone

    * or only one that I could find that did when I was choosing authenticators

  • source
  • parent
  • hideshow 2 child comments
  • [–] 1 point 6 days ago (1 child)

    Thats actually a pretty conmon feature. Obviously the password managers do though keeping passwords and mfa in the same place kinda negates the multi in multifactor.

    Twilio does as well.

    Don't know about Google's, its been like a decade since i used it. It just was the worst.

    Aegis does too but it requires a bit more work to sync the backups to cloud storage or what ever you choose. That's actually a key feature for a lot of people looking to own their data though.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 14 points 1 week ago

    Best part is Microsoft reprompting me 3 times in a row each time i open the browser when connecting with my elevated account....f m$

  • source
  • [–] 4 points 1 week ago (3 children)

    They do have TOTP as an option...

    They juat push that stupid app.

  • source
  • hideshow 3 child comments
  • [–] 7 points 1 week ago

    I used to be able to log into my work account with TOTP, I used my Bitwarden. Recently somebody changed something, and now Authenticator is enforced. As a bonus, I don't yet have a work device so they are trying to force me to have it on my personal phone... fat chance

  • source
  • parent