Incredibly based.
Come to think of it, it’s sad how we’ve got so accustomed to be suggested Google Authenticator and the other big corp data funnel 2FA apps by the services that support it
Q: I got a prompt asking me to grant permission for the app to access my location. Why am I seeing this?
A: You will see a prompt from the Authenticator app asking for access to your location if your IT admin has created a policy requiring you to share your GPS location before you are allowed to access specific resources. You’ll need to share your location once every hour to ensure you are still within a country where you are allowed to access the resource.
And? I don’t give a shit what the admins of my network want. It’s DFA – they don’t deserve to know that. Ergo, I don’t use the MS app. They can kiss my ass and fire me if they don’t trust where I am.
It’s a security / compliance policy. There is a very high chance your company has not even enabled it, have not seen anyone using it.
As I see it, you would and could use it only if you force MS Authenticator notification as the only MFA method and it is important in which country MFA prompt originates. Usually it is IP based block / whitelist which checks IP from which login originates which seems like a much more useful info, then you can also allow any MFA method.
Your question was why GPS permission is needed, you should now know why.
I am using MS Authenticator and Aegis. Using MS authenticator only for work accounts that have been setup for number matching feature, it is pretty nice to simply enter 2 digits in app than entering 6 digits in client itself any time you need to approve MFA.
Everything else that supports standard TOTP whether work related or personal is on Aegis - it is a much better TOTP app.
That depends. More of the popular ones don’t encrypt the secret keys, they can just be read out with root access or even with the use of ADB (the pull command), not even speaking about reading the memory contents while booted to a recovery.
Some even uploads the keys to a cloud service for convenience, and they consider it a feature.
Sounds more like a bad design than purposefully left backdoors. Very few devices are rooted and usually you cannot get root without fully wiping your device in process. As for cloud upload, that indeed is convenient for most regular users. I prefer encrypted offline backup like Aegis does, but you need to think about regular folk if they would loose or wipe their device.
It’s not bad design, it’s definitely intentional, however I agree that it’s probably not for having backdoors, but for convenience. Average people forget their passwords all the time, and with encryption that level of carelessness is fatal to your data if they have not saved it somewhere, which they probably didn’t do.
Very few devices are rooted and usually you cannot get root without fully wiping your device in process.
I’m pretty sure the system is not flawless. Probably it’s harder to find an exploit in the OS than it was years ago, but I would be surprised if it would be really rare. Also, I think a considerable amount of people use the cheapest phones of no name brands (even if not in your country), or even just tablets that haven’t received updates for years and are slow but “good for use at home”. I have one at home that I rarely use. Bootloader cannot be unlocked, but there’s a couple of exploits available for one off commands and such.
Setting restrictions on what 2FA/authenticators we can use. I imagine it’s only a matter of time before Google functionally makes it so you can only use theirs when using their services.
Edit: I assumed it was some of the messages I’ve seen elsewhere, my mistake. I don’t need everybody repeating the same comment. Please read the responses before telling me the exact same thing over and over again guys lol
At least for what I just posted this isn’t a restriction. Its a recommendation. You can still use any other app. I thought its nice that they recommend the privacy friendly ones.
I’ve gone tons of places that say use Google Authenticator (only) and I just summon the QR code and scan with Aegis anyway and it always works fine. I’ve never seen a place that required a certain one.
In the following responses Mauro was very professional. l haven’t heard much about recently but Linus had some high tier anger issues. Most of the cases I was following back then he was right, but desperately needed to cool off.
Poor Mauro: they weren’t good at what they loved, they blamed others for their failings, and their community leader was nuts.
Jokes aside, we’ve already got toxic right there. Linus isn’t right, but someone like that would be fired with good cause. It’s one thing to make a mistake, it’s quite another to blame your co-workers for your own shoddy work.
I wonder if the guys here who are moaning like the snowflakes they are about Linus’ way of conveying the message (not the message itself) are from the US? I sometimes really wonder about the US mindset. The boss is critisizing you justifyably but in an inadequate tone? Hell breaks lose. But as an employee insisting on healthcare, an adequate number of days on paid time off, unionazing or at least have an able workers’ representation? Nah, that’s unheard of.
How about having some priorities? Grow a pair and chose your battles more wisely. The boss criticizes you? If he’s right, own up to your mistakes. Want some rights you are actually entitled to? Yeah, that’s what you fight for.
Don’t allow your boss to speak to you like that, unionize, and fight for your workers rights - including the right for dignity and respect, listed in the Universal Declaration of Human Rights, but also for higher pay and better working conditions.
After twenty plus years of watching LKML and Linus’s behavior in general, I have to concur with you. Reading a lot of the ‘linus is an asshole’ threads, there’s generally a clear runup towards an outburst.
Just recently he called some developers out because it seemed evident they weren’t testing their patchsets on bare metal. So it’s not just code that gets called out, it’s also development methods that end up causing upstream pain.
One does not simply break userspace. You’ll receive more than just angry bug reports. There are restless maintainers who will not sleep. And the great corporations are ever watchful.
Why so many people see letter as containing onlt 3 words and ignore part where Linus says that maintainer shouldn’t randomly blame userspace, how unrelated error code is(it’s like if your router crashed with message “there is no milk in the fridge”), repeats that maintainer shouldn’t randomly blame userspace, asks if patch good enough, says “WE DO NOT BREAK USERSPACE”,
I’m angry, because your whole email was so horribly wrong, and the patch that broke things was so obviously crap.
The fact that you then try to make excuses for breaking user space, and blaming some external program that used to work, is just shameful. It’s not how we work.
Linus only reacted this way to people who really should have known better. This isn’t a “here is my first ever patch, I read all the rules and I hope I didn’t break any” situation. The person he is chewing out is a kernel maintainer. They are someone who is experienced and trusted and Linus was rightly angry that this poor quality work was submitted.
However… Linus has also worked a lot on himself in the past few years, fully acknowledging that he shouldn’t behave this harshly when someone fucks up. If the same situation was to present itself today, he would be much more professional, but would probably still be a bit angry and you’d know about it.
Linus is a flawed human being, but credit where it is due, he has worked on some of his character flaws.
lemmy.one
Newest