• theo@lemmy.world
    link
    fedilink
    arrow-up
    18
    arrow-down
    4
    ·
    1 year ago

    Unfortunately, Microsoft will often force their own 2FA app when logging in to 365.

        • /home/pineapplelover@lemm.ee
          link
          fedilink
          arrow-up
          1
          ·
          1 year ago

          Unless your organization forces specifically microsoft authenticator, then yeah. However, for several schools, that’s never been an issue, there should be an option to use a third party authenticator in small text.

      • ParetoOptimalDev@lemmy.today
        link
        fedilink
        arrow-up
        9
        arrow-down
        1
        ·
        1 year ago

        If your admins change the default away from Authenticator only they see bright red “MS 365 insecure” banners.

        So… Its a dark pattern that technically allows other options.

        • dayvid@lemmy.world
          link
          fedilink
          arrow-up
          4
          ·
          1 year ago

          TOTP codes can be phished. Technically FIDO2 keys like Yubikeys are one of the only phishing-resistant authenticators out there now, because they’re tied to the official domain of the real site and won’t authenticate to a fake.

          Passkeys are similarly phishing resistant, and Microsoft Authenticator will basically have passkey support added early this year. For now it’s actually not phishing resistant! Though it’s somewhat better than TOTP.

          The issue is that phishing resistance is important but it doesn’t stop session stealing (someone getting ahold of the cookie on your computer that confirms you’re signed in and have done MFA). But it does make it harder to steal sessions because phishing resistance means attackers need to get it from your computer instead of intercepting a fake login.

          Just a little technical backstory around why admins are needing to lock down auth methods in more ways as attacks become more sneaky and the more sophisticated attacks become automated and easier and thus more frequent.