Comment by jiggawatts | Hacker News Reader

Comment by jiggawatts | Hacker News Reader

I can understand if a product has limitations, or odd edge cases, but Microsoft MFA is purposefully designed to be user-hostile.

Some examples that came up recently in "not corner case" scenarios:

1) For tenant-to-tenant guest access, each user must re-register MFA for each tenant they've been invited to. So if you already have the Authenticator app installed and configured, it doesn't matter. It'll prompt you to create a new entry each time. I have dozens already and clocking up.

2) When logging in to Azure, Microsoft has purposefully added "dark patterns" to hide options related to other, non-Microsoft-Authenticator technologies. They're available, but they're always tiny, tiny links squirrelled away so that you're inexorably lead towards using the Authenticator app. Someone at Redmond really wanted their KPIs met at Yubikey's expense.

3) If you get a new iPhone, unlike everything else on the phone, the Authenticator app will not transfer your MFA registrations. Apple IOS will securely transfer your accounts, passwords, etc... but Authenticator is special. You need to first configure a consumer account(!) to back up your enterprise MFA settings, and then restore them manually. At which point... none of them will work, and you get partial instructions that you can't follow. If you've wiped your old phone (e.g.: trade-in or repair), you are now locked out.

All of the above were designed, architected, and developed on purpose. None of these are oversights, bugs, or missing features.

Let me add one that I ran into, which doing a search a whole slew of people have. Their MFA simply does not work - not in edge cases - in very basic straight forward cases.

I sign up for an account. It wants a phone number. I enter the phone number. It sends a text to validate it. Except it never sends the text. I go into my profile and enter it there. It still wants me to enter it for validation, and wants to send a text. Which it again never sends. You can try the next day, you can try two weeks later - they just don't send a text. My carrier is sprint/tmobile, spam/phishing protection is disabled. And no, like most other places, they won't robocall you and voice-read you the code.

A month later, your account is blocked because you didn't validate it.

Now, this is for their free accounts. If you pay them, this issue does not exist. In online forums, their support staff make ridiculous claims: our mfa server is down (for 2 weeks?), reinstall your browser, here's some instructions on how to click the "send sms" button.

So I use free microsoft accounts as temp accounts for orders that are going to spam me, and when they die in a month - all good.

Here's the thing though - for all of microsoft's user hostile practices, google's products are fifty times worse.

funny thing though - if you look at smaller shops specializing in one or two products, you don't have to use microsoft or google stuff, and there is a better alternative for everything those two make.

There is possibility that you configured your T-mobile account to block certain or even all SMS. It happened to me before. Especially if you are in a family account and someone else is the primary account holder, and they mistakenly configured your line.

which is the first thing I checked. which is why I also specifically stated it does this with spam filters and text blocking off. it's in two places: there's an option in you call plan (which is not in mine) and there's a toggle in the portal. You have to have both the service plan option, and the toggle on. I have neither.

The thing is, this was an issue with both sprint and tmobile (before the merger). if you google for it, you'll see people on att and verizon are having this issue as well.

I think the op was correct - they're purposely making it hostile for users of the free tier. which is hilarious, because they do show you ads on the webmail client. you'd figure they'd want people using their email..

which i do. for spam, with the bonus that I don't have to deactivate the account - they kill it for me after i can't validate in a month. it's finally a feature.

Considering their mfa is depended on by millions of people daily and is a critical part of many people's infrastructure, it would be near impossible for Microsoft to have any outages for more than a few minutes that aren't reported around the world.

> for all of microsoft's user hostile practices, google's products are fifty times worse.

I’ve never experienced any of these issues with Google Authenticator, or heard of anyone experiencing anything similar.

google authenticator is not the same thing. that's an rsa soft token type thing, not a text to your phone. if you want issues with google texts on cell phones, pick a bad word, add "google fi" to it, and you'll get some hits. then repeat that for google voice.

now, what you can compare it to, is when google sends you an sms for authentication. and you don't get it, and they lock your account. customer service - sure, chat from your phone, as long as you have their app, and if you don't, then install their app - from google play, which is locked because you can't confirm your phone number. then figure out they locked your gmail, phone, and all google apps, while deleting all your data. why? because you worked with a dev on an app 3 years ago, and that dev was found by google to work with another dev 2 years ago, who is now a russian hacker. online chat? you need to log in first. phone number to call? they don't have a phone.

you are free to google for an hour to somehow contact them, and a big if/then loop they call AI will reply with an off-topic template, then delete your youtube channel. if you complain more, they'll trash your employer's production servers in GCP.

If you're not in the USA, Amazon and perhaps Microsoft do stupid fucking things with a mobile number.

when I lived in france i had a second french phone#. amazon worked great. then I was in kiev for a year, and it worked alright with their local number too.

but amazon i never had an issue with, maybe because i've had an account with them from the days when they only sold books. but i actually completely stopped using amazon years ago - the fake crap and fake reviews make the experience not worth my time.

> MFA simply does not work - not in edge cases - in very basic straight forward cases

I completely agree. At my workplace, attempting to add your account to the MFA app fails. If you click on the big obvious 'add account' button, it asks you to sign in to the account you're setting up MFA for. And when you enter your username and password, it then redirects to the MFA setup page and asks you to set up MFA. And if you follow those prompts, you end up back at the sign-in page. And so on.

Instead, you have to skip past the obvious 'add account' button, and click on a + symbol in the top right, and from there you can add the account by scanning a QR code generated on the MFA settings page.

FYI: that QR code thing is The world standard for configuring an RSA soft token.

Yeah, it's really easy to get into an infinite loop with the various Microsoft login screens.

I've had trouble with all the services (MSFT and others) sending texts. I blame Verizon more than the big tech folks though, as their SMS is remarkably unreliable.

That said, my first pass through MSFT 2FA hell left me with the indelible impression that they really didn't understand 2FA. I only reluctantly use their products, and have been hit with various "Temporary problem" when attempting to login. Its worse with SSO, in case you are not sure.

More to the point, every scenario where I'm forced to use a MSFT product, another product exists which does a far better job, with far fewer bugs, far better performance, and far better UX/UI. Its as if MSFT hates users.

I actually agree with design choice #3: the authentication app should be tied to the phone and not the cloud account. Having to re-register your MFA app when you switch phones is exactly how I would design it too.

There's a chicken-and-egg problem here when people don't have access to both the old and new phone at the same time (or, as you say, they do a factory wipe), but to me that only suggests they need a different recovery process, not leak the customer's MFA secrets to the cloud.

Your third point is not actually true.

Well, it is true, but there are a lot of other apps which don’t transfer to new phones. Google’s Authenticator app is such an example.

From what I understand: anything using the Secure Enclave as primary storage cannot be transferred.

Google Authenticator can transfer details to a different phone these days.

You get a notification at the top of the App for a few days to alert you to the transfer.

Maybe it's a poor example then, I wasn't aware of that.

Mobile BankID (Scandinavian Identity Service), my British Banking app and Okta verify definitely can't transfer to a new phone. I know because I checked recently.

My overall point is: they're not alone, this is a common issue for Apps.

Mobile BankID is running in the sim card, and transfers fine to new phones. Except the ones with embedded sims, i guess :/

My (Swedish) BankID definitely doesn't run from the sim card. :S I've had 4 phones in Sweden and I had to enroll it as a new device each time in Nordea.

This must be very recent - I changed my phone around June and this was not an option. So I moved all my accounts to Authy, and moved that instead, which brought everything to the new phone flawlessly.

For those confused, like me, it seems that Google has finally updated their Authenticator app on iOS.

https://apps.apple.com/us/app/google-authenticator/id3884976...

I, like others, stopped using this app because it had dangerous bugs (app could delete the wrong token) and several limitations.

The consumer "workaround" mentioned uses some sort of iCloud "Secure Enclave" Backup file of some sort and will restore data on a new phone if you use the "Recovery" option, which does transfer regular boring TOTP and the primary "consumer" MSA account and the recovery locks/bricks the same data on the previous phone in the process.

The additional issue mentioned is that while it works great for the MSA account and any boring TOTP you have setup it doesn't work at all for other Azure AD accounts of seemingly any stripe (Corporate Microsoft 365 accounts, B2B, B2C), which is surprising given it is Microsoft's Authenticator and they highly recommend using it, but it fails for Corporate MFA transfers. It just gives an error icon and not very useful error message.

Reply on news.ycombinator.com