Hacker News Reader

Comment by RachelF | Hacker News Reader

I too, liked it.

However, some apps that I need for work, like Microsoft Authenticator, no longer work under GrapheneOS.

https://www.theregister.com/on-prem/2026/03/10/microsoft-tig...

Yeah, I'm hanging on with GrapheneOS (on a Pixel) until their native-hardware (Motorola) phones come out, which hopefully will solve this. As I understand it, third-party (banks and so forth) app vendors have to accept their security attestation, which they don't right now, but (I hope) will with Motorola behind them.

Graphene is NOT a jailbroken/rooted OS, its a real secure unrooted, bootloader locked OS, and MS Authenticotor works just fine. If anything does not work its related to dependency of the App maker on a certain attestation google play services grapheneos.org/articles/attestation-compatibility-guide

Root =/= insecure. You probably have administrator access on your home computer operating system, and can very likely do online banking via the web browser with no issues. A secure API is possible regardless of the host metal, operating system, or user permissions.

Do you refer to app-accessible root or user root access? The former is absolutely inherently insecure and compromises the security model of Android/GOS.

Root on computers is insecure. Malware can steal secrets from other applications. We're just used to it, but the Android security model is much better.

Bingo!

Compliance =!= Security

This does not play a role - even if you lock your bootloader Play Integrity Checks still fails, and that means you can't use certain apps, MDM and overall restricts your usage. Thank Google for that.

Sounds like your work has been using your personal phone for free

Microsoft Authenticator works on my GrapheneOS (not rooted).

I hate how common it's become for companies to force you to install things on your personal phone. Even worse is some of them demand you install a MDM profile on your personal phone which feels 1000% over the line of reasonable.

I've just refused to install such things on my phone.

You want me to have email and teams/slack on my phone? Sorry, I won't install the spyware. Want to pay for me to have a second phone with it? Okay. No? Well then, I just won't have email on my phone.

Sure if you are in a strong stable position in life you can do that. The average person doesn’t want to rock the boat and cause troubles in their life so they install the invasive mdm profile.

It needs to be made illegal imo. The company should provide you a device if you need one for the job.

> invasive mdm profile

What do you think is invasive in an MDM profile? It's just a channel to push data to your phone. Your information outside the work container stays private. Even inside the work container nobody can actually fetch any data from those apps.

I do agree with you though - a company must provide phones to their employees, not force them to enroll into their MDM services. The latter should be only for exceptional cases, e.g., gain temporarily access to corporate VPN, WiFi, etc., on your private device.

My company MDM doesn't consider GrapheneOS good enough to give me access to email/calendar - impasse?

"I would love to, but I do not have a compatible phone. I cannot afford it."

Spyware aside - I think about data breaches, even if my phone is "secure/compliant".

Scenario: Your account gets compromised somehow. It's signed in to your personal phone. Company data gets leaked or ransomed.

Your phone and its contents are now evidence.

From the linked article it seems this is related to Entra accounts which are Azure cloud related.

Google Authenticator works?

I think Google authenticator implements the standard OTP which lots of apps (including keepass) should support. Microsoft uses their own propietary crap

You can try to add the standard OTP even for Microsoft crap. If it asks you to register for mfa and opens the screen that says something about downloading the Microsoft authenticator app there is a small link at the bottom, letting you use another app. Then you get a qr code that you can scan with any other auth app.

I use a basic OTP password instead of Microsoft's ironically less secure (see SMS as 2FA) with my work MS account. Perhaps your org disabled it but it is definitely something a Microsoft account can do.

Proper Microsoft authenticator setup is more secure than OTP because it's pushed based and doesn't allow users to copy paste their OTP codes into phishing sites. Google also prefer push based MFA for this reason.

Push based, sure. Allowing SMS, I still hold, undermines all of this.

They "secure" this behind password which you entered to trigger the SMS push in the first place.

Offering an "out" to a more secure flow means your secure flow may as well not exist.

Additionally, phishing a pushed OTP is not really much harder since you can trigger the push and then just have the user finish off the flow for you, provided they don't read the IP or whatever you display them (they won't, they think they're signing in), effectively the same as a TOTP.

Reply on news.ycombinator.com