twofas / 2fas-ios

Source code for 2FAS iOS app
GNU General Public License v3.0
480 stars 35 forks source link

microsoft.com 2024 9 digits provided (Incorrect Secret key (only numbers 2 to 7, letters) #77

Closed bcookatpcsd closed 4 months ago

bcookatpcsd commented 5 months ago

Microsoft account forcing mfa authentication..

Trying to register and they are providing a nine digit code 0-9

2fas cannot pair

image

Advanced token settings only allows up to 8 digits..

(why is M$ changing things..)

I'm sure they have a need.. but

(other random information..) https://superuser.com/questions/1801695/using-oathtool-instead-of-microsoft-authenticator

That's not a TOTP key – it's a pairing code specifically for Microsoft Authenticator's online setup (most likely for its "push" 2FA feature).

I don't see an option to 'choose another'..

image

image

I don't think there is a resolution here.. but possibly an opportunity to update the Q&A/Support section of 2fas

Open to suggestions..

Thank you in advance. :/

KobeW50 commented 5 months ago

Is the 9 digit code not the secret key?

What is the length of the one-time-password that Microsoft asks you to verify when you press 'Next'?

worldsdream commented 5 months ago

It works fine here on Microsoft (just tried it).

bcookatpcsd commented 5 months ago

Not sure what is working..

From the screenshot with the qr code and 9 digit code.. try and add it to 2Fas..

photo_2024-02-23_12-38-05 photo_2024-02-23_12-37-56

When you scan the attached QR code it works?

When you try and add the service with the 9 digits it works?

photo_2024-02-23_12-44-32

Thank you in advance..

adocyn commented 4 months ago

Yes, it's a Microsoft ®️ ™️ thing and not an open TOTP standard. Can't implement that, but probably there's an option on "admin" side of things to allow for standard TOTP while setting up the account. @bcookatpcsd I'm not sure if we can handle every possible case in FAQ 😄 Especially that those configurations could vary based on configuration specific to the corporation. I've seen a login which required to enter two digits from the login screen into the notification in Microsoft app just to accept it. Crazy stuff, also optional and configurable 😄