I transitioned everything to Bitwarden. Password manager, passkeys, and MFA code generation all in one app that works on all of my devices.

And then I started to self-host it via Vaultwarden and transferred all the data.

Depends on your org. I have a yubikey, a phone app Authenticator, a pin and my regular SSO login/password. All of which I have to use constantly, because some dumbass did something dumb like two fucking years ago. So I can hardly get shit done. Plus the same dumbasses who probably fucked all this up are writing production code for an actual product. Please kill me.

I too have a yubikey. My advice, have something that functions as a backup.

Other than that, yes. It's way better than alternatives.

Are you using the slightly more expensive one capable of generating TOTP codes?

I also use a Yubikey too, but I still have to use another 2FA app for services that don't support passkeys yet.

Seconding the ask on the extension, I hate having to log into my secret store every 15 minutes while working on stuff

So secure.

Thanks for the aneurysm. I feel for you.

Oh ffs I got annoyed just reading the comment I can't imagine the hell of having to do that

I bet the security "experts" who designed this are busy jerking each other off about how "secure" they've made everything

Fuck, and here I thought AGS progressive controllers were bad. Remote desktop into the controller using a commonly known username and password to get a "salt", "hash code", "iterations", "password length", and "server name". Enter all that onto a website that has to be logged in to, all to get a generated password which is used to remote desktop desktop into the same progressive controller under a different account. Password changes every 24 hours. Oh, and did I mention that this is typically done on an active casino floor? Good times.

But why though

I remember reading an article once which referred to research which suggested that making people change passwords every month made their accounts less secure, because they have to go extra steps to remember them - which usually translates to making them really obvious and/or storing them where they’re easily accessed. In one of my previous jobs where we had to change passwords every month, basically everybody would have their password written on a post-it on their computer monitor.

I have a Yubi key that crashes Authenticator when I select the option to it l use it. It goes into a loop asking to touch the button and type the PIN. But it does not wait for input, it just keeps creating windows until it crashes.

I have multiple accounts configured on the same yubikey, but it seems like any of the Microsoft login portals expect you to always use the account you most recently signed in with. So any time I need to switch accounts (which is often, I have different accounts for each different testing environment and access level), I have to type in my pin and touch my key twice - once to allow Microsoft to try logging in with the wrong account and fail, and then another time where it asks which account I want to use. 🙃

I have a 3d printed access card holder that also holds my work yubikey. Very handy

Da ba dee da ba da

My company... runs both, for some reason.

Hmmm. Conversation, yes.

As someone on the other side, in IT support, you can fix this yourself and I wish more people would.

Before your old phone gets wiped and sent to the graveyard, log in using authenticator, and go to "view account" from any of the online pages for Microsoft (if you're unsure, try login.microsoft.com ). Go to your security options, and you should see all the info you need to remove the old authenticator and add a new one.

From here you can also add backups, which I encourage everyone to do.

It saves you from having to call IT all the time to fix it, and since you don't have to go through the usual back and forth of verifying who you are, or whatever, and getting them to do a thing, you can take care of it for yourself, by yourself, without those unnecessary delays.

Your IT people will appreciate it, and you'll have to talk to them a bit less as a result.

You mean system administrators?

i think that's just all of lemmy at this point

microsoft has sucked arse for eons. the real q is why the fuck IT keeps buying their shit.

You might be able to use a "normal" (TOTP-compliant / Google Authenticator-like) 2FA app even with Microsoft work accounts. One of the prompts to download MS Authenticator has a "use a different app" option:

I assume admins can disable it, but it's also easy to miss. On top of this, this prompt only shows up when attempting to add a new MS Authenticator, since there is no "other app" option among the authenticator type choices.

Idk my microsoft account works fine with ente auth.

There's actually a duo feature that does that.
Normally apps can't cross authenticate like that because they don't have the ability to talk to each other in a standard way that's also verifiable and secure. Teams could have a way to share your auth to something else, but it's much more difficult for it to know that the thing asking for access actually is something that's supposed to be able to do so.
OneDrive is built in to Windows, so it's able to use the authentication you use to log into the computer to talk to the Microsoft servers. (Essentially, there's like a million steps and layers of indirection).

I once created a Microsoft account (for a Windows 7 machine I think) and entered a Google address. It didn't seem to mind. It's my Microsoft account to this day, not that I have much use for it. Maybe it's gotten more weird nowadays.

I don't have the exact timeline at hand, but Microsoft Accounts (originally Microsoft Passport) as a Microsoft service wide SSO were originally cooked up at Microsoft, while Hotmail was a separate service that Microsoft acquired. And this was in the late 1990s. I guess they originally designed the account system to be independent of the whole web portal nonsense that was fashionable at the time.

...anyway, I think it's good thing that Microsoft let you use whatever email address you want with it and not force you to use Hotmail/Outlook.

What?

An @outlook.com / @hotmail.com account is already a Microsoft account to begin with. If you enter one of those that already exists, you’re just signing in. There is no “new mail account”.

It makes sense to have the user use their own existing email address so that they have it as recovery option, most people don’t need another email address.