Unless your organization forces specifically microsoft authenticator, then yeah. However, for several schools, that’s never been an issue, there should be an option to use a third party authenticator in small text.
TOTP codes can be phished. Technically FIDO2 keys like Yubikeys are one of the only phishing-resistant authenticators out there now, because they’re tied to the official domain of the real site and won’t authenticate to a fake.
Passkeys are similarly phishing resistant, and Microsoft Authenticator will basically have passkey support added early this year. For now it’s actually not phishing resistant! Though it’s somewhat better than TOTP.
The issue is that phishing resistance is important but it doesn’t stop session stealing (someone getting ahold of the cookie on your computer that confirms you’re signed in and have done MFA). But it does make it harder to steal sessions because phishing resistance means attackers need to get it from your computer instead of intercepting a fake login.
Just a little technical backstory around why admins are needing to lock down auth methods in more ways as attacks become more sneaky and the more sophisticated attacks become automated and easier and thus more frequent.
Aegis Authenticator is the best 🏆
Unfortunately, Microsoft will often force their own 2FA app when logging in to 365.
Not true, I’ve always used Authy.
It became true in the past 6 months for me after always using Aegis.
Unless your organization forces specifically microsoft authenticator, then yeah. However, for several schools, that’s never been an issue, there should be an option to use a third party authenticator in small text.
No they don’t. That’s a configuration setting.
If your admins change the default away from Authenticator only they see bright red “MS 365 insecure” banners.
So… Its a dark pattern that technically allows other options.
TOTP codes can be phished. Technically FIDO2 keys like Yubikeys are one of the only phishing-resistant authenticators out there now, because they’re tied to the official domain of the real site and won’t authenticate to a fake.
Passkeys are similarly phishing resistant, and Microsoft Authenticator will basically have passkey support added early this year. For now it’s actually not phishing resistant! Though it’s somewhat better than TOTP.
The issue is that phishing resistance is important but it doesn’t stop session stealing (someone getting ahold of the cookie on your computer that confirms you’re signed in and have done MFA). But it does make it harder to steal sessions because phishing resistance means attackers need to get it from your computer instead of intercepting a fake login.
Just a little technical backstory around why admins are needing to lock down auth methods in more ways as attacks become more sneaky and the more sophisticated attacks become automated and easier and thus more frequent.
Best one out there
Thank you, how about for iOS users?
Buy a different phone… Apple is terrible in so many ways