Register a SA Forums Account here!
JOINING THE SA FORUMS WILL REMOVE THIS BIG AD, THE ANNOYING UNDERLINED ADS, AND STUPID INTERSTITIAL ADS!!!

You can: log in, read the tech support FAQ, or request your lost password. This dumb message (and those ads) will appear on every screen until you register! Get rid of this crap by registering your own SA Forums Account and joining roughly 150,000 Goons, for the one-time price of $9.95! We charge money because it costs us money per month for bills, and since we don't believe in showing ads to our users, we try to make the money back through forum registrations.
 
  • Post
  • Reply
Tiny Timbs
Sep 6, 2008

I stay up to date on cruft lore. He uses a Jitterbug.

Adbot
ADBOT LOVES YOU

cruft
Oct 25, 2007

I have it on my smartphone, I just have my Chromebook handy more frequently than I have my smartphone handy.

The point is, Microsoft Authenticator doesn't run on Microsoft Windows.

It seems like $EMPLOYER might care that I installed the Bonzai Buddy launcher on my phone, which I gave permission to draw over any app, and subsequently can change the map everybody ignores to show wherever I happen to be at the time, so that Bonzai HQ can evilproxy attack my account. But, no, in this one instance, I am not only allowed to run a super important work app on my personal device, but I am required to.

cruft fucked around with this message at 21:31 on Mar 22, 2024

Dick Trauma
Nov 30, 2007

God damn it, you've got to be kind.

slidebite posted:

Oh, I'll have to do that.

Isn't the TPM hardware needed for encryption, like Bitlocker?

Last Chance
Dec 31, 2004

Thankfully since Windows is primarily only good for gaming these days, it should be fine. you likely don’t need to encrypt your Steam directory.

wash bucket
Feb 21, 2006

Last Chance posted:

Thankfully since Windows is primarily only good for gaming these days, it should be fine. you likely don’t need to encrypt your Steam directory.

Speak for yourself.

Klyith
Aug 3, 2007

GBS Pledge Week

Dick Trauma posted:

Isn't the TPM hardware needed for encryption, like Bitlocker?

Sorta. If you use bitlocker for full-disk encryption of the system drive, TPM key storage is the most convenient method. (But you can also not use it and just type a password every time you boot the PC.) If you only use Bitlocker for removable drives, it's not needed at all.

TPM is also used for Windows Hello, for logging in with PIN or fingerprint. (But in this case no TPM has no reduction in user functionality, just less security against local attack. Not really a big deal for a desktop in your house.)

mobby_6kl
Aug 9, 2009

by Fluffdaddy

cruft posted:

I have it on my smartphone, I just have my Chromebook handy more frequently than I have my smartphone handy.

The point is, Microsoft Authenticator doesn't run on Microsoft Windows.

It seems like $EMPLOYER might care that I installed the Bonzai Buddy launcher on my phone, which I gave permission to draw over any app, and subsequently can change the map everybody ignores to show wherever I happen to be at the time, so that Bonzai HQ can evilproxy attack my account. But, no, in this one instance, I am not only allowed to run a super important work app on my personal device, but I am required to.

Employer might in fact care, which is why they let you install any cool poo poo on your phone

c0burn
Sep 2, 2003

The KKKing

Dick Trauma posted:

This morning I saw a popup about Dynamic Lighting being available and it took me to a settings panel I hadn't seen before that allowed me to fiddle with the LED logo on my mouse.

Same but for a mouse that doesn't have customisable lights. Good job Microsoft!

Harik
Sep 9, 2001

From the hard streets of Moscow
First dog to touch the stars


Plaster Town Cop

cruft posted:

:actually:

The primary reason most businesses require Microsoft Autheniticator is because they're implementing a Microsoft product called "Entra". This sends a request to the cloud from the device trying to authenticate, which triggers a push notification to the enrolled Authenticator device, triggering a popup with (hopefully) a little map of the geoip location of the authenticating device, and a box to enter a 2-digit code, which is presented to the authenticating device by the cloud server. If you enter the code, you're in.

There is no explanation of why the map is there, so most people ignore it, which is why a type of proxy attack called "evilproxy" is making big waves right now. Nobody thinks anything of it if the map shows Indonesia, because it was never explained why the map mattered.

I don't know why Authenticator doesn't, at a minimum, compare the location against the phone's built-in location services, to at least ask "are they within 500 miles of each other", but I'm sure Microsoft has their reasons.

None of this is a problem that Webauthn (Fido U2F) suffers from, since it looks up a unique asymmetric key pair by hostname. If a malicious proxy server tries to authenticate, the Fido device doesn't know what keypair it's trying to trick out of the user, so it just fails. Bing bang, an entire class of attack sidestepped by a nice architecture.

Anyway. I still have to use Entra, which means I need to lug around my personal Chromebook while I'm on work travel. It's probably for the better, since it prevents me from doing any non-work stuff on the work laptop.

e: in closing, "something you know + something you have" is all well and good, but when your entire architecture is vulnerable by design to a man-in-the-middle attack, it's worthless.

lol that's so terrible and worthless, A++ at making this incredibly stupid system. Why can't you run microsoft authenticator on your phone, or is it something stupid like "it doesn't actually support anything useful on iphone but it exists just to confuse people"?
E: I should try reading to the end of the page next time, lol.

cruft
Oct 25, 2007

Harik posted:

lol that's so terrible and worthless, A++ at making this incredibly stupid system.

Well, it *is* an improvement over reusable passwords. It's just a two steps forward, one step back sort of thing.

~Coxy
Dec 9, 2003

R.I.P. Inter-OS Sass - b.2000AD d.2003AD

cruft posted:

There is no explanation of why the map is there, so most people ignore it, which is why a type of proxy attack called "evilproxy" is making big waves right now. Nobody thinks anything of it if the map shows Indonesia, because it was never explained why the map mattered.

I don't know why Authenticator doesn't, at a minimum, compare the location against the phone's built-in location services, to at least ask "are they within 500 miles of each other", but I'm sure Microsoft has their reasons.

Also, the GeoIP or whatever of your company's web proxy is usually in some big city that may or may not be anywhere near where you are located.

My company's Citrix VDI terminates in India or France.

mobby_6kl
Aug 9, 2009

by Fluffdaddy

cruft posted:

Well, it *is* an improvement over reusable passwords. It's just a two steps forward, one step back sort of thing.
I'm not so sure.

We have to use this poo poo at work and generally it'll just let me log in without even asking for a new token. Like I just click "login" and it goes right through, for weeks at a time.

E: there's also an option to send a code by SMS if the cloud poo poo isn't working for whatever reason

mobby_6kl fucked around with this message at 11:04 on Mar 24, 2024

Harik
Sep 9, 2001

From the hard streets of Moscow
First dog to touch the stars


Plaster Town Cop

mobby_6kl posted:

I'm not so sure.

We have to use this poo poo at work and generally it'll just let me log in without even asking for a new token. Like I just click "login" and it goes right through, for weeks at a time.

E: there's also an option to send a code by SMS if the cloud poo poo isn't working for whatever reason

so it's a nuisance to use, not a sane standard and a "or has $20 to slip the teen at the kiosk" authentication? absolutely perfect. nothing to improve, security has reached its peak.

E: Theoretically it has the token on your machine that's tied with your IP and doesn't just let you login from anywhere in the world. Theoretically. Hopefully.

Harik fucked around with this message at 17:31 on Mar 24, 2024

nielsm
Jun 1, 2009



Harik posted:

so it's a nuisance to use, not a sane standard and a "or has $20 to slip the teen at the kiosk" authentication? absolutely perfect. nothing to improve, security has reached its peak.

E: Theoretically it has the token on your machine that's tied with your IP and doesn't just let you login from anywhere in the world. Theoretically. Hopefully.

You can absolutely disable SMS authentication in MS Authenticator, and in fact you need to go out of your way to add it as things are. The option to add it is hidden behind a "show additional options" button.

I believe that business accounts can also add policies about what kinds of authentication they accept, and possibly limit your access to various things depending on what kind of authentication you used. They can also make your sign-ins last longer on certain devices or from certain networks/IP addresses, so you don't need to verify as often when (for example) you're using a managed device on the company network.

CaptainSarcastic
Jul 6, 2013



nielsm posted:

You can absolutely disable SMS authentication in MS Authenticator, and in fact you need to go out of your way to add it as things are. The option to add it is hidden behind a "show additional options" button.

I believe that business accounts can also add policies about what kinds of authentication they accept, and possibly limit your access to various things depending on what kind of authentication you used. They can also make your sign-ins last longer on certain devices or from certain networks/IP addresses, so you don't need to verify as often when (for example) you're using a managed device on the company network.

Yeah, that's my experience. Pretty sure we have SMS verification disabled, so if you don't have your phone with Microsoft Autheticator on it you're pretty much locked out if you do need to log in. At the office and the home machines I use for work, it retains the authentication for a long time and I can just log in as normal.

Thanks Ants
May 21, 2004

#essereFerrari


There's a huge amount of control that is granted through Conditional Access which anybody using Entra (Microsoft 365) seriously should have the licenses for and be implementing. For example you can decide that you will never see an MFA prompt if you're using a managed device that meets all the compliance rules, has a TPM chip in it, and is using biometrics to authenticate you to it, or choose to only display an MFA prompt on those devices in certain applications like ones related to finance etc.

It's always a balancing act but throwing MFA prompts multiple times a day for someone doing normal office tasks leads to fatigue and devalues it as a security method, so there's lots of initiatives going on that try to be more selective about when you're going to be asked to auth.

CaptainSarcastic
Jul 6, 2013



Thanks Ants posted:

There's a huge amount of control that is granted through Conditional Access which anybody using Entra (Microsoft 365) seriously should have the licenses for and be implementing. For example you can decide that you will never see an MFA prompt if you're using a managed device that meets all the compliance rules, has a TPM chip in it, and is using biometrics to authenticate you to it, or choose to only display an MFA prompt on those devices in certain applications like ones related to finance etc.

It's always a balancing act but throwing MFA prompts multiple times a day for someone doing normal office tasks leads to fatigue and devalues it as a security method, so there's lots of initiatives going on that try to be more selective about when you're going to be asked to auth.

My bank asks me to authorize logging in every. Single. Time. It's a bit annoying, but I guess if it helps keep people out of my account I'm willing to put up with it.

~Coxy
Dec 9, 2003

R.I.P. Inter-OS Sass - b.2000AD d.2003AD

CaptainSarcastic posted:

Yeah, that's my experience. Pretty sure we have SMS verification disabled, so if you don't have your phone with Microsoft Autheticator on it you're pretty much locked out if you do need to log in. At the office and the home machines I use for work, it retains the authentication for a long time and I can just log in as normal.

If you follow the phone transfer process, it offers to wipe your old phone. This will lock you out of your account if you allow it, since the MS Auth app on the new phone is stuck in a useless state until you re-enroll every account again.

~Coxy posted:

I've installed Explorer Patcher, but I can't get Process Explorer to show up in the systray.
When I go into the old-school "Notification Area Icons" control panel, and change Process Explorer to "Show icon and notifications", it doesn't stick.
Same with anything else. Any ideas?

You can actually drag-and-drop icons in the systray overflow to the systray proper.
https://github.com/valinet/ExplorerPatcher/issues/1157

susan b buffering
Nov 14, 2016

CaptainSarcastic posted:

My bank asks me to authorize logging in every. Single. Time. It's a bit annoying, but I guess if it helps keep people out of my account I'm willing to put up with it.

i just wish my credit union had proper totp instead of sms 2FA

chocolateTHUNDER
Jul 19, 2008

GIVE ME ALL YOUR FREE AGENTS

ALL OF THEM

susan b buffering posted:

i just wish my credit union had proper totp instead of sms 2FA

I suspect that a lot of credit unions are using the same third party vendor for their apps. Over the last 10 years I’ve been a member of three different credit unions due to various moves, and they all look and behave exactly the same right down to the lack of proper totp support.

Kalman
Jan 17, 2010

chocolateTHUNDER posted:

I suspect that a lot of credit unions are using the same third party vendor for their apps. Over the last 10 years I’ve been a member of three different credit unions due to various moves, and they all look and behave exactly the same right down to the lack of proper totp support.

They are. Jack Henry and Associates, iirc.

Combat Pretzel
Jun 23, 2004

No, seriously... what kurds?!
I have an odd issue with a friends' laptop, running latest Windows 11, where the taskbar doesn't properly start and locks up instead. The desktop itself is functional, as in the context menu shows and is functional, as well regular Explorer windows show up when I run the process manually.

Eventually I noticed that ShellExperienceHost.exe doesn't show up. And the Task Manager doesn't list any processes in the Details tab, and when killing processes in the other Processes tab, it acts like they didn't get killed, and eventually it locks up too.

I blanked disabled anything non-Microsoft in any autostart locations known to man, used tools like ShellExView and such to disable anything that hooks into Explorer, etc. Even all these Microsoft Forum useless standard responses like sfc /scannow and all the dism stuff. It still doesn't budge. I can't start the Settings app either to trigger anything related to resetting the PC.

Anyone ever had anything like that and found a solution? Meanwhile I told him to prep an USB and install over it like in the olden times, in the hopes it'll fix it without doing a proper fresh install that needs to reinstall all applications.

Klyith
Aug 3, 2007

GBS Pledge Week

Combat Pretzel posted:

Eventually I noticed that ShellExperienceHost.exe doesn't show up. And the Task Manager doesn't list any processes in the Details tab, and when killing processes in the other Processes tab, it acts like they didn't get killed, and eventually it locks up too.

Anyone ever had anything like that and found a solution? Meanwhile I told him to prep an USB and install over it like in the olden times, in the hopes it'll fix it without doing a proper fresh install that needs to reinstall all applications.

I had this exact thing happen in Windows 10. For me it was preceeded by a sort of creeping dysfunction of all other UWP apps. At the end the only UWP apps that worked were settings and the MS Store -- which would open but every app it tried to update errored out.

And no, I didn't find a solution. "In-place upgrade", the now official term for over-the-top install, is easily the best option.


(At the time I used the Reset My PC which semi-worked: my taskbar worked again, but MS Store was totally broken. :psyduck: And Reset is super annoying, you have to reinstall everything. Those UWP experiences were probably the most frustrating thing I have ever dealt with in a PC, and I've been through a lot.)

Combat Pretzel
Jun 23, 2004

No, seriously... what kurds?!
Didn't there use to be a Refresh option (not Reset) in the settings app, that did trigger an in-place upgrade? --edit: Then again, that settings app refused to start, too, so whatever lol.

--edit: Also, it's a goddamn travesty in which ways they hosed up Task Manager. I mean, it's easily "fixed" by downloading Process Explorer, but still. It used to be unkillable, now it's like a piece of flash paper in hell.

Combat Pretzel fucked around with this message at 22:23 on Mar 25, 2024

Serotoning
Sep 14, 2010

D&D: HASBARA SQUAD
HANG 'EM HIGH


We're fighting human animals and we act accordingly
Windows Explorer just took literally 4-5 seconds to even indicate it was launching, let alone become actionable. How incredibly awful.

wash bucket
Feb 21, 2006

Serotoning posted:

Windows Explorer just took literally 4-5 seconds to even indicate it was launching, let alone become actionable. How incredibly awful.

Why are you even trying to browse the file system? Just tell Copilot which file you want to view!

Blue Footed Booby
Oct 4, 2006

got those happy feet

Serotoning posted:

Windows Explorer just took literally 4-5 seconds to even indicate it was launching, let alone become actionable. How incredibly awful.

That's started happening to me the first time I open it after restarting. It may happen other times, but that's when I've really noticed it. It's pretty pathetic. All my drives are SSDs, and I have no optical drive.

biznatchio
Mar 31, 2001


Buglord
If there's a network drive in pinned/favorites section on the left bar of Explorer, that will make Explorer perform terribly whenever that network drive is unavailable or needs to be initially connected; because loading that bar's contents blocks the entire window until its complete.

Every time I've seen explorer start to crawl it's because a network share found its way into that list.

Sininu
Jan 8, 2014

Onedrive hijacks print screen and alt+print screen shortcuts and I can't do anything about it? There's nothing about shortcuts in its settings... And save screenshots to onedrive is off already.


Also why do I have to log into all the MS products again every 2-4 weeks? I'm logged into their thing on Windows so why can't they just use that information? Some services require me to re-enter my password and 2fa code, while others just want me to click on log-in. Madness

Rawrbomb
Mar 11, 2011

rawrrrrr

Sininu posted:

Onedrive hijacks print screen and alt+print screen shortcuts and I can't do anything about it? There's nothing about shortcuts in its settings... And save screenshots to onedrive is off already.



What do you mean hijacks? Like you press print screen and your one drive folder popsup? In windows 11 it should default to the sniping tool, which can save images to your one drive.

Sininu posted:

Also why do I have to log into all the MS products again every 2-4 weeks? I'm logged into their thing on Windows so why can't they just use that information? Some services require me to re-enter my password and 2fa code, while others just want me to click on log-in. Madness

Yeah, nothing new here. Its never worked that seamlessly.

Sininu
Jan 8, 2014

Rawrbomb posted:

What do you mean hijacks? Like you press print screen and your one drive folder popsup? In windows 11 it should default to the sniping tool, which can save images to your one drive.
If I set Onedrive to start with Windows ShareX can't register the hotkeys for itself because Onedrive took them already.
I've been always just using Dropbox, but I'm trying out Onedrive for more free storage.

Rawrbomb
Mar 11, 2011

rawrrrrr

Sininu posted:

If I set Onedrive to start with Windows ShareX can't register the hotkeys for itself because Onedrive took them already.
I've been always just using Dropbox, but I'm trying out Onedrive for more free storage.

If you go check in Settings > Accessibility > Use the Print screen key to Open Screen Capture

Is that on or off? If its on try toggling off and rebooting and see if share X will work?

I've never heard of ShareX, but I know tons of people using various different screen capture tools on W11 without an issue. Half my team uses a stupidly old program we have a license for that windows 7 wasn't even a twinkle in its eyes, and its still working fine.

Sininu
Jan 8, 2014

Rawrbomb posted:

If you go check in Settings > Accessibility > Use the Print screen key to Open Screen Capture

Is that on or off? If its on try toggling off and rebooting and see if share X will work?

It's off already. Idk if I did it or it defaults to off.

nielsm
Jun 1, 2009



Sininu posted:

If I set Onedrive to start with Windows ShareX can't register the hotkeys for itself because Onedrive took them already.
I've been always just using Dropbox, but I'm trying out Onedrive for more free storage.

I can't remember exactly what I did to fix this, but as far as I remember, it involved activating OneDrive via that hotkey it registers, and then going through its feature presentation, and at the end rejecting or disabling it. Then it stopped registering that hotkey afterwards.

Sininu
Jan 8, 2014

nielsm posted:

I can't remember exactly what I did to fix this, but as far as I remember, it involved activating OneDrive via that hotkey it registers, and then going through its feature presentation, and at the end rejecting or disabling it. Then it stopped registering that hotkey afterwards.

Thank you nielsm! You're always so helpful c:

DerekSmartymans
Feb 14, 2005

The
Copacetic
Ascetic
Found out:

DerekSmartymans posted:

I've got the weirdest problem with some (not all) of my Windows 11 programs. The text and icons, whether on buttons or in text fields, get "blurry" or "smeared out" a couple of seconds after opening up correctly. This doesn't happen with things like word processing or web pages/web text, butt mainly seems to show up in game launchers such as Steam or Epic Games launchers (and the new Eve Online launcher), as well as the new default Outlook. Usually you can move the mouse over the smeared text/icon and it will clear up to "readable" right away, but may fade back to blurry after a second or two. I recorded a short video with ShareX of my Outlook getting wonky and it shows the transitions quite well. This is Windows 11, all current updates, but has been happening for a while now and doesn't seem to be clearing up on its own!



It was f’d up anti-aliasing settings in the nvidia control panel.

nocal
Mar 7, 2007
What's that bad man doing to my OS?

Blue Footed Booby
Oct 4, 2006

got those happy feet

Another day, another ad

I've disabled Copilot every way I can find and still periodically get this. I googled it and found a series of MS community posts where the support dorks recommended looking for an option to disable in the Settings menu. People are saying they disabled copilot with group policy and still get the ads. The support dorks do not respond further.

Vic
Nov 26, 2009

malae fidei cum XI_XXVI_MMIX
This must be the US vs EU thing. I'm seeing none of that and I did nothing but click no to everything MS asked me about.

Adbot
ADBOT LOVES YOU

Blue Footed Booby
Oct 4, 2006

got those happy feet

Wanna trade countries? ;_;

  • 1
  • 2
  • 3
  • 4
  • 5
  • Post
  • Reply