Microblog Memes

Thanks for the aneurysm. I feel for you.

I bet the security "experts" who designed this are busy jerking each other off about how "secure" they've made everything

Oh ffs I got annoyed just reading the comment I can't imagine the hell of having to do that

But why though

Fuck, and here I thought AGS progressive controllers were bad. Remote desktop into the controller using a commonly known username and password to get a "salt", "hash code", "iterations", "password length", and "server name". Enter all that onto a website that has to be logged in to, all to get a generated password which is used to remote desktop desktop into the same progressive controller under a different account. Password changes every 24 hours. Oh, and did I mention that this is typically done on an active casino floor? Good times.

There's actually a duo feature that does that.
Normally apps can't cross authenticate like that because they don't have the ability to talk to each other in a standard way that's also verifiable and secure. Teams could have a way to share your auth to something else, but it's much more difficult for it to know that the thing asking for access actually is something that's supposed to be able to do so.
OneDrive is built in to Windows, so it's able to use the authentication you use to log into the computer to talk to the Microsoft servers. (Essentially, there's like a million steps and layers of indirection).

I transitioned everything to Bitwarden. Password manager, passkeys, and MFA code generation all in one app that works on all of my devices.

And then I started to self-host it via Vaultwarden and transferred all the data.

Depends on your org. I have a yubikey, a phone app Authenticator, a pin and my regular SSO login/password. All of which I have to use constantly, because some dumbass did something dumb like two fucking years ago. So I can hardly get shit done. Plus the same dumbasses who probably fucked all this up are writing production code for an actual product. Please kill me.

Seconding the ask on the extension, I hate having to log into my secret store every 15 minutes while working on stuff

I remember reading an article once which referred to research which suggested that making people change passwords every month made their accounts less secure, because they have to go extra steps to remember them - which usually translates to making them really obvious and/or storing them where they’re easily accessed. In one of my previous jobs where we had to change passwords every month, basically everybody would have their password written on a post-it on their computer monitor.

Hmmm. Conversation, yes.

You mean system administrators?

i think that's just all of lemmy at this point

As someone on the other side, in IT support, you can fix this yourself and I wish more people would.

Before your old phone gets wiped and sent to the graveyard, log in using authenticator, and go to "view account" from any of the online pages for Microsoft (if you're unsure, try login.microsoft.com ). Go to your security options, and you should see all the info you need to remove the old authenticator and add a new one.

From here you can also add backups, which I encourage everyone to do.

It saves you from having to call IT all the time to fix it, and since you don't have to go through the usual back and forth of verifying who you are, or whatever, and getting them to do a thing, you can take care of it for yourself, by yourself, without those unnecessary delays.

Your IT people will appreciate it, and you'll have to talk to them a bit less as a result.

I have a Yubi key that crashes Authenticator when I select the option to it l use it. It goes into a loop asking to touch the button and type the PIN. But it does not wait for input, it just keeps creating windows until it crashes.

microsoft has sucked arse for eons. the real q is why the fuck IT keeps buying their shit.

You might be able to use a "normal" (TOTP-compliant / Google Authenticator-like) 2FA app even with Microsoft work accounts. One of the prompts to download MS Authenticator has a "use a different app" option:

I assume admins can disable it, but it's also easy to miss. On top of this, this prompt only shows up when attempting to add a new MS Authenticator, since there is no "other app" option among the authenticator type choices.

Da ba dee da ba da