Design Flaw Has Microsoft Authenticator Overwriting MFA Accounts, Locking Users Out (csoonline.com) 68
snydeq writes: CSO Online's Evan Schuman reports on a design flaw in Microsoft Authenticator that causes it to often overwrite authentication accounts when a user adds a new one via QR scan. "But because of the way the resulting lockout happens, the user is not likely to realize the issue resides with Microsoft Authenticator. Instead, the company issuing the authentication is considered the culprit, resulting in wasted corporate helpdesk hours trying to fix an issue not of that company's making."
Schuman writes: "The core of the problem? Microsoft Authenticator will overwrite an account with the same username. Given the prominent use of email addresses for usernames, most users' apps share the same username. Google Authenticator and just about every other authenticator app add the name of the issuer -- such as a bank or a car company -- to avoid this issue. Microsoft only uses the username."
The flaw appears to have been in place since Authenticator was released in 2016. Users have complained about this issue in the past to no avail. In its two correspondences with Schuman, Microsoft first laid blame on users, then on issuers. Several IT experts confirmed the flaw, with one saying, "It's possible that this problem occurs more often than anyone realizes because [users] don't realize what the cause is. If you haven't picked an authentication app, why would you pick Microsoft?"
Schuman writes: "The core of the problem? Microsoft Authenticator will overwrite an account with the same username. Given the prominent use of email addresses for usernames, most users' apps share the same username. Google Authenticator and just about every other authenticator app add the name of the issuer -- such as a bank or a car company -- to avoid this issue. Microsoft only uses the username."
The flaw appears to have been in place since Authenticator was released in 2016. Users have complained about this issue in the past to no avail. In its two correspondences with Schuman, Microsoft first laid blame on users, then on issuers. Several IT experts confirmed the flaw, with one saying, "It's possible that this problem occurs more often than anyone realizes because [users] don't realize what the cause is. If you haven't picked an authentication app, why would you pick Microsoft?"
Comment removed (Score:5, Funny)
Re: Microsoft. Design flaw. (Score:5, Funny)
I did, but it was overwritten
Comment removed (Score:5, Funny)
Re: Microsoft. Design flaw. (Score:5, Funny)
Re: Microsoft. Design flaw. (Score:5, Funny)
You need to reinstall the joke.
Re: Microsoft. Design flaw. (Score:5, Funny)
There are only three options for a Microsoft joke. Do you want to Abort, Retry or Fail?
Re: Microsoft. Design flaw. (Score:5, Funny)
Re: Microsoft. Design flaw. (Score:3, Funny)
Eaten by Bob.
Re: (Score:2)
If I had Moderator points today, I'd mod this entire SET OF COMMENTS +1 Funny.
Well done, SlashDotters
Re: (Score:2)
If I had Moderator points today, I'd mod this entire SET OF COMMENTS +1 Funny.
Well done, SlashDotters
Completely agree with you
Re: (Score:2)
Re: (Score:2)
This is the first time since ages that the first 5 or even 7 comments are rated +5 FUNNY
I literally nearly spilled my coffee over the keyboard!
Re: (Score:2)
(Not all options available in all states)
Typical MS flaw, too (Score:5, Funny)
It's a stupid mistake. It's been there for years. They blame everyone else for the issues it causes.
Could it BE any more Microsoft?
Re:Typical MS flaw, too (Score:5, Funny)
It's a stupid mistake. It's been there for years. They blame everyone else for the issues it causes.
Could it BE any more Microsoft?
Yes. If they had put out a public statement declaring it a design feature, and then spelled out how it supposedly helped in their newfound pursuit of security, it could be just a tiny little bit more Microsoft.
Re: (Score:2)
Alright, NightFlameAuto... you win this round.
Re: Typical MS flaw, too (Score:2)
The feature is that you'll need one mail address per account.
Re: (Score:2)
Great story for Funny and parent is my pick for funniest of the many. (I'd mod it funnier, but I cannot remember when I last had a mod point to give (though I'm always receiving abuse from censor mods).)
Re:Typical MS flaw, too (Score:4, Funny)
It's a stupid mistake. It's been there for years. They blame everyone else for the issues it causes.
Could it BE any more Microsoft?
It's part of their new Security strategy. They're securing the blame squarely on someone else.
Re: (Score:2)
Did you just make me go watch a Windows 95 guide by capitalizing ONE word?
Yes you did!
"If you haven't picked an authentication app..." (Score:5, Interesting)
"...why would you pick Microsoft?"
Because you have little choice in some scenarios? If you're using AzureAD/Entra ID, it seems MS has made it very hard to use a different MFA provider. Even when you do, they often still try to find ways to shoehorn MS Authenticator in front of your users, hoping to get them onto it as well, despite your best efforts. Not at all unlike how Windows loves to inform you that various default apps have been reset due to "corruption" as a laughable horseshit way to try to get you to use Edge, etc.
Re: (Score:3)
Re: (Score:2)
I currently use 1Password as the authenticator app for a clients Microsoft Account based login system - despite literally just having asked me for my 2FA code from that app, Microsoft then still proceed to insist that I should set up Microsoft Authenticator on the account...
I have used MS Authenticator in the past, and luckily never been hit by this issue, but have moved off it to 1Password over the past few years. The sole reason I chose it before was because it was one of the only free authenticator apps
Re: (Score:3)
A year or two ago I switched from the 1password paid service to the (free, open-source, with paid support) Bitwarden service which has proven to be superior for my purposes, (including cost savings, but technical also). This is for savings passwords in general.
A while ago I tried to standardize on using the Authy authenticator app, however it is no longer supported, but I still have accounts setup for both it and Google Authenticator. I'm in a disorganized state which needs to be addressed relatively soon,
Re: (Score:3, Funny)
We use Microsoft's MFA and have the option to receive a phone call or text message when authenticating rather than using their software. Shouldn't everyone who uses MS MFA have this option?
Re:"If you haven't picked an authentication app... (Score:5, Insightful)
Re: (Score:2)
Re:"If you haven't picked an authentication app... (Score:5, Insightful)
You can use any TOTP tool, even ones you roll yourself. Here's an example using the command line utility "oathtool":
seed="your totp seed"
oathtool -b --totp "$seed"
Here's one implemented in bash using openssh for the digest calculation: https://github.com/jakwings/to... [github.com]
Getting the secret key is fairly easy, if you get it during the initial setup. They usually offer a QR code and there's usually a link to setup with an alternate TOTP tool, and that alternate link will generally provide the secret key as-is. You can also extract it from an exported set of keys from Google Authenticator (and others), but that's more than I want to write here :-)
Long story short: you don't need to use MS's Authenticator, though they certainly try to corral people towards it.
Re:"If you haven't picked an authentication app... (Score:5, Informative)
This is untrue. TOTP is explicitly designed to resist attacks that try to derive the secret from the time and 6-digit code. See this discussion [stackexchange.com] for example.
Re: (Score:2)
Re: (Score:2)
I use a particular system where I *have* to use Microsoft Authenticator (it's just a corporate system - nothing to do with Azure). It's not a typical "enter the 6 rotating numbers" type auth flow - you do some stuff online, then you get a prompt on your phone, you do some stuff there, then online it lets you in.
I haven't checked, but I'll bet my lunch that auth flow is baked into some Microsoft products and so not easily replicated by another auth product. Even if it were though, I'd still *have* to use Mic
Another reason not to use Authenticator (Score:3)
Whenever I set up people to authenticate I always told them to use either a phone call or text message because they're both more reliable than the software. This just adds more confirmation for that decision.
Re: (Score:2)
I absolutely hate having to rely on an Authenticator.
It's about the best way I can think of to lose access to an account accidentally.
Re: Another reason not to use Authenticator (Score:4, Insightful)
Re: (Score:3)
If it's done properly, not some special bullshit they wrote on their own, you can save your keys and use them to generate a password on anything that can tell time. There are TOTP libraries for pretty much any language you would want, and if your favourite doesn't have one the algorithm is pretty straightforward to implement.
Re: (Score:3)
Good lord, no! The ease of compromising cell phone service to intercept SMS texts makes your advice a hard security no-no.
Re: (Score:2)
I don't own a cellphone since the company I work for provides one. This is not an option for personal user. If you must MFA then use an email or a YubiKey.
Re: (Score:2)
Define reliable. Reliably works when needed to log in? Or reliably keep people out of accounts?
Authentication apps were created as a response to a very real problem of number / SIM hijacking. Someone can clone your number and get your 2FA accounts without putting any effort into compromising your device. An attack against you authentication app is far more difficult.
If you want convenience at the expense of security, just remove 2FA all together and then pat yourself on the back for a job well done.
Sim swap attacks (Score:1)
Whenever I set up people to authenticate I always told them to use either a phone call or text message because they're both more reliable than the software. This just adds more confirmation for that decision.
You're intentionally increasing the risk that their accounts can be compromised with a Sim Swap Attack [wikipedia.org]?
The scam begins with a fraudster gathering personal details about the victim, either by use of phishing emails, by buying them from organised criminals,[3] directly socially engineering the victim, or by retrieval from online data breaches.
Armed with these details, the fraudster contacts the victim's mobile telephone provider. The fraudster uses social engineering techniques to convince the telephon
Re: (Score:2)
That's really bad advice. Phone calls and text messages can be intercepted or redirected.
Comment removed (Score:3)
Re: (Score:2)
So...like Aeon Flux oral data capsule exchange then?
Not just an MS authenticator issue (Score:1)
The summary is wrong: The issuer does appear in MS Authenticator, if the QR code is properly implemented. I can see Amazon, Login.Gov, etc. listed.
I have one site that has the issue (Payrix). All of the other sites I use work and appear fine in Authenticator.
The Payrix site works in Google Authenticator but simply shows my email address as the login; I assume I'd have the same issue if I added a 2nd site with the same email.
I agree that Microsoft should make it more difficult to overwrite existing settings,
Re: (Score:3)
I agree that Microsoft should make it more difficult to overwrite existing settings, but these sites have some responsibility to make sure their QR codes work correctly.
There should be no way to overwrite an existing one unless you formally delete it. That is certainly their responsibility, as that means any rogue QR code could overwrite one as well.
IMO, they should also make it trivial for the owner of the key to recover and/or backup the secret key, and to modify the key label to ensure none ever overlap. If you attempt to add one with the same name as an existing one, it should, IMO, offer you the chance to name it something else, while also noting you could go back to
Just Microsoft? (Score:2)
It seems like everyone's design has similar flaws. Why do we restrict how many second factors? I would love to completely blacklist email and SMS authentication for everything as an option. But to do that, I need more than one authenticator app and a few backup codes. I have a couple USB/NFC authenticator keys, I have devices with biometric login that can act as their own passkey. Picking one is a bad plan all around.
TOTP is nice and universal, but it's a last resort just above backup codes. I'd rather
Re: (Score:2)
The requirement to type something in is just a choice by whoever wrote the app you're using. TOTP requires your key and the current time. You don't type either of those in.
Re: (Score:2)
True - but again, they don't need to all share one. Invalidating one shouldn't have to invalidate them all. And I don't know of any software that keeps the TOTP info ready for browser autofill but protected by a physical second factor. Passkeys and security keys will eliminate the typing for the devices that support it.
Re: (Score:2)
TOTP is the only one that doesn't let the other party restrict what kind of device I use.
Re: (Score:2)
That's not true. U2F and Passkeys are both hardware agnostic standards that just rely on the browser to select what options are supported and implement a standard protocol. It's still held back by another party, but not the vendor.
Re: (Score:2)
Passkey has an attestation feature, so that you can require a passkey comes from a known vendor. I've see the option to require it in cloud security configuration. https://developers.yubico.com/... [yubico.com]
Re: (Score:2)
Passkeys are FIDO auth, that means they're subject to the FIDO authentication levels certification. https://fidoalliance.org/certi... [fidoalliance.org]
The remote party then needs to keep an up to date FIDO metadata Statement https://fidoalliance.org/metad... [fidoalliance.org] which enumerates which devices are allowed.
I have been burned by this already: I cannot use my hw key (Nitrokey) to access my state's e-government, because L1 certification is required, and hard to do for an OSS token.
Re: (Score:2)
Oh, absolutely. Someone doesn't understand what a primary key is. That's depressingly common. When the primary key is composite even more heads explode.
I was referring to this:
TOTP shouldn't be a last resort. It can easily do exactly what you want. One of the reasons why it doesn't are that various companies
Single point failure (Score:5, Insightful)
I want to point out that while Microsoft deserves a fail whale for this... it does point out an important issue.
Anyone who is relying on a single app to reliably store their token secret, and doesn't have a backup way of authenticating, is one bad release (or stolen phone - if the token secret isn't backed up somewhere) away from ending up in the same situation.
Re: (Score:2)
Well it's security, so the data should be backed-up and accessible to another applet. "Aegis" applet (Android) supports importing most backup/export files. Also many authenticator applets can display plain-text/QR-code of the secret, allowing it to be copied to a phone/tablet/laptop. Yes, it's a lot of work, but if one doesn't make a 'spare key', one deserves the misery resulting from the phone being stolen/reset/damaged by an update (See: CrowdStrike).
happened to me (Score:1)
This happened to me. I over-wrote a not-very-important account. Learned my lesson the easiest way possible.
Microsoft Authenticator has a backup/restore feature but doesn't seem to restore everything you need for all accounts (at least when you restore on a different device).
I forgot my iOS password for a few minutes today, brain fart. This is very unusual for me, I was shitting a brick over MFA for a few minutes.
Bug, not a design flaw (Score:2)
A design flaw would indicate the software needs to be rearchitected.
They need to adjust their key constraints and probably modify a getter/setter.
That's a bug.
There's no need to fear (Score:1)
Lennart will fix it by pulling it into the Windows systemd equivalent.
Is this for real? (Score:2)
Corrupting the rating-system (Score:2)
It shouldn't take long to realize that when a new secret is loaded into MS authenticator, the old one stops working. Why wasn't this reported years earlier?
Why does such an incompetent piece of software have a "4.6" usability-rating? Hell, a security app requiring network access should be worrying enough to downgrade its usability. Do MS consumers really have such a low opinion of their own online-safety? If you ever want proof that mega-corporations are corrupting the rating system, this is it.
Re: (Score:3)
It's a Microsoft app - people have been conditioned over _decades_ to have things inexplicably suddenly stop working. That is normal computer behaviour to them. Why would they report it?
Such a stupid design (Score:3)
Exactly what I expect from Microsoft in the scurity-space: Barely functional crap.
Let me guess. (Score:2)
Let me guess, they wrote this code in javascript. Oh wait no, must be visual basic.
If Microsoft built the Titanic... (Score:2)
If Microsoft built the Titanic, after it sank, then the Olympic would have sunk. While issuing a press release its going to make its crew "iceberg focused."
JoshK.
Re: If Microsoft built the Titanic... (Score:2)
Re: (Score:2)
Quite...and indeed. And the captain was not using a feature (lookouts with binoculars) so was running blind, and overclocked could not reboot after the crash. By the time they agreed upon the problem, they were on the ocean floor...dead already. :)
Later the archaic paradigm was continued in Windows 11, also called the Andrea Doria...because the interface was the same archaic one and the distance feature was omitted as a new feature.
JoshK.
"If you haven't picked an authentication app, why (Score:2)