The incident highlights Microsoft’s ongoing efforts to protect Entra credentials on rooted Android and jailbroken iOS devices, where malware and weakened security controls increase enterprise identity risks.
oh come on… this had nothing to do with rooted devices. sounds like a rooted device could still snoop this after tge fix.
I able to run Authenticator in a work sandbox because I’m rooted but have to use it. That means my rooted device protected your dumb apps from my personal apps. what a load of fud.
Shall I pretend to be surprised by a Microsoft product having a fatal security flaw?
Yeah, I’m just annoyed that they keep trying to develop critical infrastructure when they’ve had structural problems at doing precisely that for multiple decades already…
at this point, I feel it’s all on purpose and these articles are just telling their criminal friends they are closing it so use the next ones
they are more concerned about putting Ai in to everything.
Can we stop having security issues for at least a week?
Thanks
We’ve automated all aspects of the security issue cycle. All the computer power we will build this decade will work as fast as possible to create slop code, find holes in it, slop together some more code, find holes in it… And so on.
At a certain point, patching your software will become impractical. Critical updates will have lifecycles measured in minutes. At this point, you’ll just have a permanently running update service that writes new patches on the fly, it will communicate with a distributed network of AIs that are telling your local computer what the security flaws are and how to fix them, multiple times a second. Security will suddenly be about having the network and computational powert to keep up. Attckers will be using the same tools to find the same holes at the same time as the defenders. Being able to write your patches (or exploits) faster that the other system is what hacking will become. Just raw computational power duking it out.
I don’t know if any of this will be true, I just kinda made it up, but it sounds good enough.
Games taught me that all you will need is to have enough investment in Hacking skill, and then you are just a minigame away.
Unless AI fully breaks cryptography, in that scenario we’d surely converge quickly to actually having mathematically infallible security on the blue team side? Software is finite, thus, software flaws are finite.
Best part is Microsoft reprompting me 3 times in a row each time i open the browser when connecting with my elevated account…f m$
Unfortunately, most people that have this fall into two, maybe 3 camps
- work installed it and i use it because they said to
- work uses proprietary MS mfa so i have to
- Actually likes Microsoft?
source, I’m in camp 2
- Installed it because it’s the recommended one when signing up for a Microsoft account even though they let you use other authenticators
Source: most people in my college
Anyone who is in camp 3 is a literal sociopath…
They do have TOTP as an option…
They juat push that stupid app.
I used to be able to log into my work account with TOTP, I used my Bitwarden. Recently somebody changed something, and now Authenticator is enforced. As a bonus, I don’t yet have a work device so they are trying to force me to have it on my personal phone… fat chance
They do? My work account is forced to use the app, I can’t seem to change it to TOTP
Quite possible that’s a setting by your admin, my MS.account gers 2FA from Aegis.
Did IT on the side at my last job.
The Microsoft authenticator push notifications are the thing that they have integrated into other products (for us it was the VPN) so we were forced to use authenticator instead of TOTO because otherwise the VPN wouldn’t authenticate with how they set it up…
I am just happy I pushed for bitwarden for so long so people can stop using Name2026! Format and other crap.
