Microsoft's new "passwordless by default" is great but comes at a cost

Nice. My favorite Microsoft Authenticator feature is that the iOS and Android versions aren't interoperable. There is no way to export the private keys from an iOS device so they can be imported on an Android device and vice versa.

Preceded by “even after users create a passkey, they can’t go passwordless until they install the Microsoft Authenticator app on their phone.”

So not great. But not terrible. Solid Dyatlov.

To be fair, MS365 apps are frequently miserable in Edge and "natively" too.

Just a few issues of Teams and Teams only:

- statuses getting stuck or being null

- having to relogin despite the current token still clearly working

- outright crashing on JS level (fixed)

- never finishing loading in, requiring a browser cache wipe (fixed)

- lying about messages having been delivered

- messages getting dropped from mid conversation when scrolling back in history

- message history being rewritten live as things are catching up

- @everyone pings arriving localized (wtf??)

- the wrong flyout menu appearing when clicking something (???), e.g. you try to screenshare but the emoji selector shows up (fixed?)

- various localization oversights, like the calendar flyouts starting on the wrong day of the week, various strings not being translated

- if you happen to call someone at the same time they call you, buckle up, cause stuff's about to go potentially very wild

- getting into a call doesn't actually put you in the call sometimes, necessitating a full system restart (how even???)

- custom embeds for certain sites instead of just using OpenGraph, so when you link e.g. the Wikipedia article about C++, you get told it's a carcinogenic substance (debatable) group called "IARC group 2B"

- software vs hardware mute desync, sometimes resulting in a rapid fire on/off fight

- sometimes buggy at-mention tokenization behavior that triggers webhooks as many times as there are spaces in the mentioned identity's name

... and I'm sure there are countless more. Some of these are genuine dealbreaker level, that I'm confident they only get away with because of their ecosystem grip. Using Discord would be a million times nicer I swear.

Yeah, many users choose weak passwords, re-use passwords, etc. Maybe most people can't be trusted with creating and using passwords. But probably even fewer users can be trusted to actually print off their MFA backup codes and store them in a separate place from where they live. A single instance of theft, fire, or flood, or other unfortunate events, could permanently destroy someone's digital life, which has major impacts on their real life (e.g. many banks are online only.)

Text message 2FA has the advantage that recovering your phone number is pretty achievable since carriers have physical stores you can go to with a photo ID (probably more difficult but not impossible with online-only MVNOs.) SIM swapping attacks through social engineering is definitely a risk for some people, but probably not most. Unfortunately with SS7 vulnerabilities, basically any text message 2FA code can be intercepted, so it's really unideal. I think SMS alone should not be enough for account recovery or login, but as a second factor, maybe for many people the benefits might outweigh the costs.

Password managers largely fix the issue of weak passwords and password reuse. If that's too complicated, one-time use email magic links also fixes the issue. Those have their own downsides, but if a site has a "forgot my password" feature that gets reset through email, you're not losing out on a ton of security through magic links.

Of course, the downside of that is that if you lose access to your email account, you're truly screwed. In the past, when email addresses were not given freely and people got email addresses through their ISPs, if you did lose access, maybe your ISP had some way for you to prove your identity (since you pay them each month) and regaining access to it. But there's effectively no customer support for free Gmail, Yahoo, Outlook, etc. accounts. Even if you own your own domain, that's just moving the issue to your domain name registrar, which also likely doesn't have a physical location you can go in person to verify at.

If there was some guaranteed official way of proving your identity and regaining access to your email account, then I think that'd fix a lot of issues. Unfortunately that'd come with privacy risks, as it'd require having a real ID associated with your email. But MFA through hardware authentication devices (e.g. Yubikey) or through software MFA (e.g. Authy, Google Authenticator, etc.) could remain an option for privacy concerned users if they wished to avoid using a real ID for account login/recovery.

Unfortunately no perfect solutions so far, but I think Microsoft's approach here (quite similar to many other companies) may be too risky for the general population. I think companies, universities, etc. should fully lean into secure MFA, as they can easily resolve the problem if an employee or student loses their phone or hardware authentication device. But that option doesn't exist for personal email and other user accounts. There's a huge number of people in the developing world with only a single device (a phone, no other computer) and no printer for printing off backup codes (I guess you can write them down by hand, but in practice very few people anyplace will do that.) I'm not sure Microsoft (or other companies') passwordless by default approach fits that scenario. A strong, unique password for email, and then magic links for other accounts, might be a better approach for consumer accounts.

That’s actually pretty easy these days with a reasonable UX… you just choose “use a different authenticator app” instead of Microsoft Authenticator when enrolling MFA.