Hacker News Reader

Yep. Azure is just awful.

With Google SSO, I log in and do MFA once per year or so on trusted devices and any further prompt beyond that would be extremely suspicious. With Azure, I have to complete the sequence like a hundred times per day.

Forget Azure. Even Outlook/Teams flips apps between Teams/MSAuthenticator over and over. My iPhone goes into strange loops. Sometimes, its logged-out but doesnt show it and just doesnt update anything. Its nuts how vast the chasm is between Azure/Outlook/Teams vs AWS/Google.

There’s nothing more frustrating to me than seeing a billion/trillion dollar company being so lazy. That’s like spitting in the face of capitalism.

Nope. This is capitalism working as intended. They keep making money regardless of how crappy their products are. The problem is that those who suffer are not the ones making the purchase decision.

Capitalism allocates society's wealth towards the most productive members, in order to promote more productivity (in theory anyways). Microsoft has collected a massive amount of wealth, yet they're not being productive with it. In effect, they're wasting society's time since we aren't getting a return for that investment. That's unforgivable since people only live for a few decades, so Microsoft's misuse of wealth means that other businesses/individuals who would've used it to produce new/better technologies aren't able to. It's laziness, which is one of the worst traits a member of a capitalist society can have, and it's especially heinous when it's a trait possessed by an actor in such a powerful position.

Thus, many of us will die without ever seeing a real hoverboard. So when you're on your deathbed and you don't have a hoverboard, know that it's Microsoft's fault (and the government regulators who should've stopped them).

EDIT: Also applies to Apple, Google, Amazon, etc.

This explanation sounds like capitalism is a thinking being

That is not what capitalism is, according to wiki: "Capitalism is an economic system based on the private ownership of the means of production and their operation for profit."

There's nothing in here about allocating wealth, or promoting productivity. It's all about private ownership. The owner decides how to make money, and what to do with the profits. If they decide to use it for non-productive goals, that's the freedom of the owner.

Capitalism is to opposite of a society consciously allocating anything for a specific purpose, it leaves it up to every individual.

Private wealth is just an implementation detail of capitalism. An economic system’s purpose is to determine where the wealth goes, since the whole point of an economy is to share resources (e.g. so people don’t have to grow their own food)

> Capitalism is to opposite of a society consciously allocating anything for a specific purpose, it leaves it up to every individual.

Yeah, capitalism doesn’t use central planning. It’s a decentralized system in its purest form (real world requires regulators though), however it still is a system designed to answer the question: “who gets what?”

I'd say the purpose of capitalism is not to decide "who gets what", but rather to lay the foundation that the society/country as a whole get as much as possible.

The purpose of capitalism is to transfer wealth created by the labor class to the capitalist class. Every other effect is secondary and incidental.

Sorry, but I don’t see what you’re trying to say here. Tonally, you seem to be trying to contradict my argument, yet aren’t actually contradicting anything.

> I'd say the purpose of capitalism is not to decide "who gets what", but rather to lay the foundation that the society/country as a whole get as much as possible.

The question “who gets what?” can be rephrased as “how do we give everyone as much as possible?”. Capitalism offers one potential answer.

So yeah you’re not actually saying anything different from what I am. Are you even reading and/or understanding my comments?

I know that the word “capitalism” tends to invoke knee-jerk/emptional reactions because of the politics behind it, so maybe that’s what’s going on here? Fwiw, I’m not saying that capitalism is good nor bad, I’m just defining it for the sake of my somewhat facetious hoverboard comment further up.

"Who gets what" to me sounds like a zero-sum situation: we have one pie, and capitalism will decide how big a piece every member of the group gets.

"Everybody as much as possible" is a different situation where you're trying to get as many pies for the group as possible.

In the first situation the wealth of the rich people comes at the cost of the poor people, in the second situation both groups can gain, although some more than others.

What is the best way, as a SaaS that addresses pain points predominantly for the end user, to market the product to the people with purchasing power?

MS grew out of the enterprise, where as AWS/Google exploited the massses.

Im liking how Password rotation becoming a thing of the past because of this.

I didn't know that it was abnormal to be doing it multiple times a day! I just thought this was how life goes now

I have never been pinged multiple times per day. In fact, I have never been inconvenienced by this at all and all my stuff lives in Office365 and Azure. No idea where all this is coming from in this thread.

I think it depends what people mean here. As a general Office 365 user, I logon to my laptop and Outlook, Teams, Onedrive etc hasn't prompted for MFA in months. However, I have many scripts that require both "Connect-AzureAD" and "Connect-ExchangeOnline" at the start. More frustratingly some legacy features from Connect-MSOL" haven't made it into the newer scripts yet and thus often that's also needed. Those scripts take three separate logons with three separate MFA prompts, because it seems incapable of determining that I literally just authenticated and can I please use that session.

I'm sure there are settings on the admin side to control this, but I easily get a dozen Azure auth requests a day.

Google does have a more stringent mode that can be enabled on high profile / admin accounts that requires MFA more often and faster auto log outs. But it is still not too bad.

It's not Azure, it is how your organization decides to implement MFA. The only time re-MFA'ing is 'required' is when your password expires (if it does) as your token expires.

Otherwise, you could have 365 day token lifetimes if your organization configured it. Or greater.

I've never heard of anyone with azure properly set up then. In two orgs I've had the exact described behavior. Even for a school that uses azure =(

Microsoft gives well meaning but overzealous security teams too many knobs. It’s one of the reasons they can check off so many security checkboxes.

Friendly reminder to revoke your sessions when resetting compromised users. :)

FWIW GCP asks me to relogin like every 2-3 days, does not ask me for 2fa tho

It’s irritating that the “something you have” for most things can’t be “a laptop with a TPM.” It’s functionally equivalent to phone-based MFA.

The only improvement would be some screen + touch approval (like the touchbar had for privilege elevation). That would at least leave a human in the MFA loop in the event of machine compromise.

Not quite equivalent. When an attacker compromises your laptop, they'll get all of the factors in one go: steal all your bearer tokens, steal your password with a key logger, and operate the TPM remotely.

They would have to break your hard drive encryption AND have the laptop itself.

Doable by a nation state? Sure. By Bob the mugger? No.

That is fine for 98% of users.

I think the parent comment was referring to a scenario where the attacker has code executing on your laptop, not necessarily a physical seizure of the device.

That would mean the parent does not understand how a TPM operates. Several other commentors have provided good explanations to correct that fault.

Not really sure of the capabilities of nation states. They buy the tools private companies come up with.

But I think this is exaggerated security anyway. You want to keep stuff accessible. Binding anything to specific hardware is a terrible idea. My bank does that and it really sucks as a security mechanism.

Isn't the idea that you cannot compromise the TPM remotely? At least Apples SecureEnclave require physical access and the fingerprint.

You cannot compromise the TPM(e.g. read the keys stored in it, decrement increment-only counters), but most of the point of a TPM is that programs can call an interface and have the TPM perform operations using those keys. If someone compromises the machine enough to be able to run arbitrary code, they can issue those TPM operations remotely just the same as the legit software.

What you describe is somewhat related, in that one can use a combination of a TPM + some kind of a biometric sensor to build a system like TouchID or Windows Hello, and that combination would not be remotely operable. But if e.g. your mTLS client cert is stored in the TPM, you certainly would not expect to swipe a fingerprint reader on every connection that the browser establishes to the mTLS domains.

Thats why most of those TPMs have a requirement of physical interaction, i.e. you need to press a key on a Yubikey, or put a fingerprint down on an iPhone before they start this operation.

I think the idea is that you cannot impersonate a specific TPM remotely. Get root on a system, though, and you can do whatever you want with the hardware you now have access to, including using its TPM for your own purposes.

But thats exactly how it doesn't work - you are referring to Software-level TPMs. I.e. the SecureEnclave in iPhones work in a way that you can always put keys INTO the TPM chip, but cannot read it out back later, but rather have the SecureEnclave perform the crypto on chip (requiring some form of authentication, like a fingerprint read or a button press on Yubikeys). Even a full-root access should not compromise that.

To add to what jsnell said, the Yubikey requires a tap. A physical interaction from someone sitting at a laptop, which is something a trojan cannot accomplish, and a tiny barrier from the human that doesn't materially contribute to fatigue.

Now, I don't really know how much of a difference it makes for trojans, since presumably the resulting token/cookie/etc. could just be compromised in place. One might hope is scoped or at least of a more limited lifetime, I suppose.

(Compromise by trojan is one of those "all roads seem to end in pwned" events to me.)

I will note that it at least requires some authentication to happen prior to compromise, so if some IDS is blaring off alarm bells, all hope might not be lost if the device can be cut off fast enough.

(The point here, though, vs. MS Authenticator, is that Authenticator adds nothing but massive amounts of friction over the supposed Yubikey state of affairs. Edit: although, see another of my comments: apparently MS Authenticator's behavior is configurable — for uh, some reason —_so I've switched it to "less annoying" mode. So, I'll forgive MS a touch, but AIUI it's the default to fatigue the user…)

Or a laptop without a TPM? Those devices are often much cleaner than the usual phone.

I assume a lot of this is org controlled and has toggles to allow or disallow certain things, because for our AD environment when they started recommending Windows Authenticator for MFA the first thing I did was test that it works if I just add it to Google Authenticator like my other MFA things, and it did, and I've been using it that way for about two years now I think.

These things shouldn't be set by an organization. Microsoft needs to actually advocate for its users and stop creating options that make their products work shittier.

I disagree.

Many times, the org settings make a users life so much easier. We use MS SAML SSO for all our tools (office, Outlook Web, Atlassian toolstack, another ticketing tool) and I really only need to use the 2nd factor once in a few days or when I log out manually, and it's a simple sms code. Reading other comments here, my life is SO easy in this regard. I actually considera Microsoft single login with (sms) 2FA a good thing and therefore have almost 0 "mfa fatigue".

> Solutions like a Yubikey Nano are going to seem like future tech to anyone that has to put up with MS Authenticator.

Except Microsoft requires you to protect your Yubikey with a pin-code (even the consumer accounts), instantly making it unusable for your iOS device if you use it via NFC.

The funny thing is on Windows once you set up your Yubikey in Windows Hello it doesn't even matter. You are still forced to use the PIN and at that point why bother with the key.

I'd much rather skip the pin and just use Yubikey lol.

All European / UK banks I've tried are just as bad as azure as of lately. Thanks SCA, I guess.

What's the purpose of authenticating me 8 times in the span on 10m.

Open banking api that allow you to add accounts from other banks were promising but they turned out to be half baked versions, so in practice I still have n bank apps ok my phone. Not to mention I could not do online banking without my phone.

I've been seriously considering automating all of that and just have an application with a master password which access encrypted multiple banks secrets and authenticate / perform local mfa as required and let me have the banking experience (for a single bank) of, say, 10 years ago.

All of this for what? If someone hacks my account and steal my money I hope the bank mafia would be able to sort out things with the target bank and hallucinate a balance without the theft (especially because they flag tons of payments as fraudulent, requiring me to call them).