Microsoft Authenticator is about to wipe work accounts from jailbroken/rooted phones automatically 👏.

[barubary@infosec.exchange]

@merill Thank you for sabotaging my devices.

[silhouette@dumbfuckingweb.site]

@merill I'm gonna go out on a limb here and say that users that jailbreak their own private device wouldn't use MS Authenticator, and on company devices jailbreak wasn't allowed anyway.

[the_wub@mastodon.social]

@merill Blanket bans of any sort implemented by large and powerful companies always produce false positives that hurt non-customer that have to interact with their systems no matter how obliquely.

I do not use any Microsoft product or services directly but I am sure I will discover ways that this change will affect me. Likely at a moment I need to do something urgently.

Never forget Scunthorpe!

Scunthorpe problem - Wikipedia

(en.wikipedia.org)

[aetios@sns.minovsky.space]

@merill wow cringe

[jtig@infosec.exchange]

@merill people making a mountain from a molehill? On Mastodon? Never expected it…

Yes, it’s shitty. But:

• You can do non-Authenticator passkeys now, from other apps that you can use on non-Android devices
• If device-bound, Authenticator native passkeys are forced on your work device, you did not had a say in the matter already.
• If device-bound passkeys are mandated on your personal device, reject the use of work apps on your personal devices and get a security key instead!

[ralph@hear-me.social]

@merill

#alttext

Jailbreak/root detection in Microsoft Authenticator.
Between Feb to Jul 2026, Microsoft will introduce jailbreak/root detection in Microsoft Authenticator. Rollout will occur in three phases, and complete in July 2026.

Warn mode:
Your device is rooted.
You'll eventually be unable to add or use your work or school accounts on this device.
This device has been modified to bypass built-in security protections. You can no longer add or use a work or school account on this device
Contact your organization's support team for help.

Block mode:
Your device is rooted.
You can no longer add or use a work or school account on this device.
This device has been modified to bypass built-in security protections. You can no longer add or use a work or school account on this device.
Contact your organization's support team for help.

Wipe mode:
Your device is rooted.
You can no longer add or use a work or school account on this device.
This device has been modified to bypass built-in security protections.
Your work or school accounts have been removed from this device to protect your organization's data. Contact your organization's support team for help.

[longplay_games@mastodon.gamedev.place]

@merill TIL people actually use the MS authenticator

[clickhere@mastodon.ie]

@merill lol!

[thekilt@infosec.exchange]

@merill You just told a bunch of power users they either need to either relinquish control of their personal devices or start carrying a second device. Why did you think they'd be anything other than unhappy?

[crazyeddie@mastodon.social]

@thaodan @fluffykittycat @merill Why?

The keys and such associated with the authenticator app should be in a TPM. Something the bootloader can't touch. It can't get the private key to then send it to whoever.

The bootloader could attack in other ways and get the info you're accessing once logged in, but I don't think it can mess about or bypass the actual security mechanism.

I think they're trying to sell bullshit here so the ignorant support them as they lock us all down.

[crazyeddie@mastodon.social]

@thaodan @fluffykittycat @merill On phones without a TPM that's obviously not the case, but there are fewer and fewer of those and will be fewer still.

[smn@l3ib.org]

@merill what exactly is the threat model that makes a rooted device risky for an authenticator app?

[zsapi@mastodon.social]

@merill The orgs won't allow employees to use anything else, and you know it. Sadly you are not the first to require non rooted devices, but it is still another step back for freedom and privacy. Let us use our general computing pocket device as we wish. Or at least allow orgs to toggle the need for this. Though most will just enable it without question.

[dodecahedrus@mastodon.social]

@merill tell that to my org that only allows the authenticator app.

[cwg1231@defcon.social]

@smn @merill I’d like to know as well.

[thaodan@mastodon.social]

@crazyeddie @fluffykittycat @merill The bootloader itself isn't the concern but the kernel and what is started afterwards.
It is a factor even if they only use it as an excuse. Most phones don't have a TPM but an ARM trustzone which can run a software TPM. The problem is that modifying or writing isn't possible low level only over the OS or vendor API's provided.

[kontrollierterwahnwitz@sueden.social]

@merill I wonder who of the people complaining here do…

1. … own a rooted / jailbroken phone
2. … have Microsoft Authenticator installed on this phone
3. … do use MS Authenticator in combination with an Azure Active Directory account.

[fluffykittycat@furry.engineer]

@crazyeddie @thaodan @merill unlocked bootloaders are a moral imperitive. Not to mention all the ewaste created by locked devices not being repurporsable

[fluffykittycat@furry.engineer]

@agowa338 @merill I'ma have to start carrying around two phones. One for my worksona and one for me

[agowa338@chaos.social]

@fluffykittycat @merill

And make your employer pay for it. I got my work phone when I refused to put a similarly shitty 2FA app onto my personal one.

I just said I've a PinePhone with Postmarket OS and I'm not going to buy a new one just for that. + I asked if they'd cover damages for any data deleted because of someone hitting the "wipe phone" button in the MDM that would have come with it accidentally (or on purpose).

The phone was cheaper for them than continuing the discussion btw