Transcript
A wafrn woot (post) by @[email protected] saying “Microsoft Authenticator needs me to validate with Authenticator in order to log in with Authenticator to use it to authenticate another app with Authenticator. Here is the app telling me to open itself to validate itself with itself. #infosec #iHateComputers” It has a screenshot showing the microsoft authenticator app.
https://mysignins.microsoft.com/security-info
Obviously it’s very fashionable to bang two saucepans together while chanting “microsoft baaaaad”, but for anyone interested in actually learning about how this stuff works: Authenticator will never use ‘itself’ to authenticate, but you can use a second, seperate instance of Authenticator on another device to authenticate which is what is happening here. If you use Entra (or whatever it’s called this week), go to that URL to see which MFA methods Microsoft thinks you have and if, say, there’s a copy of Authenticator on a phone you no longer own, or an outdated phone number, or whatever, you can delete it.
Nothing in the UX here conveys that you should open a second Authenticator on a second device. And what if you aren’t logged into the second Authenticator? Is a third one needed on a third device? And if you aren’t logged into the third?
The original TOTP phone apps don’t require their own login. The protection is provided by the mobile OS.
Microsoft is making this complex it’s not usable.