I transitioned everything to Bitwarden. Password manager, passkeys, and MFA code generation all in one app that works on all of my devices.

And then I started to self-host it via Vaultwarden and transferred all the data.

Depends on your org. I have a yubikey, a phone app Authenticator, a pin and my regular SSO login/password. All of which I have to use constantly, because some dumbass did something dumb like two fucking years ago. So I can hardly get shit done. Plus the same dumbasses who probably fucked all this up are writing production code for an actual product. Please kill me.

Seconding the ask on the extension, I hate having to log into my secret store every 15 minutes while working on stuff

Same issue. What's the extension called?

So secure.

Thanks for the aneurysm. I feel for you.

Oh ffs I got annoyed just reading the comment I can't imagine the hell of having to do that

I bet the security "experts" who designed this are busy jerking each other off about how "secure" they've made everything

Fuck, and here I thought AGS progressive controllers were bad. Remote desktop into the controller using a commonly known username and password to get a "salt", "hash code", "iterations", "password length", and "server name". Enter all that onto a website that has to be logged in to, all to get a generated password which is used to remote desktop desktop into the same progressive controller under a different account. Password changes every 24 hours. Oh, and did I mention that this is typically done on an active casino floor? Good times.

As someone on the other side, in IT support, you can fix this yourself and I wish more people would.

Before your old phone gets wiped and sent to the graveyard, log in using authenticator, and go to "view account" from any of the online pages for Microsoft (if you're unsure, try login.microsoft.com ). Go to your security options, and you should see all the info you need to remove the old authenticator and add a new one.

From here you can also add backups, which I encourage everyone to do.

It saves you from having to call IT all the time to fix it, and since you don't have to go through the usual back and forth of verifying who you are, or whatever, and getting them to do a thing, you can take care of it for yourself, by yourself, without those unnecessary delays.

Your IT people will appreciate it, and you'll have to talk to them a bit less as a result.

I remember reading an article once which referred to research which suggested that making people change passwords every month made their accounts less secure, because they have to go extra steps to remember them - which usually translates to making them really obvious and/or storing them where they’re easily accessed. In one of my previous jobs where we had to change passwords every month, basically everybody would have their password written on a post-it on their computer monitor.

I have a Yubi key that crashes Authenticator when I select the option to it l use it. It goes into a loop asking to touch the button and type the PIN. But it does not wait for input, it just keeps creating windows until it crashes.

I have multiple accounts configured on the same yubikey, but it seems like any of the Microsoft login portals expect you to always use the account you most recently signed in with. So any time I need to switch accounts (which is often, I have different accounts for each different testing environment and access level), I have to type in my pin and touch my key twice - once to allow Microsoft to try logging in with the wrong account and fail, and then another time where it asks which account I want to use. 🙃

Da ba dee da ba da

My company... runs both, for some reason.

Hmmm. Conversation, yes.

You mean system administrators?

i think that's just all of lemmy at this point

microsoft has sucked arse for eons. the real q is why the fuck IT keeps buying their shit.