0

My organization will require Multi-Factor Authentication (MFA) in a few days and we use Microsoft accounts. On the internet I read there are authenticator apps for Linux. One of them is Authenticator.

I'm not up to date with Microsoft services, however, it looks like the app offers many, i.e. "Microsoft To-Do" and "Microsoft Azure". Also on Microsoft's website there are several different methods: "Authenticator app", "Phone", "Alternate phone", "Security key", "Office phone".

I tried to set up the "Authenticator app" and "Security key" authentication methods. In both cases I ended up with the following error:

(authenticator:365334): Gtk-CRITICAL **: 08:26:43.787: _gtk_css_corner_value_get_y: assertion 'corner->class == &GTK_CSS_VALUE_CORNER' failed
2023-07-12T06:26:49.446034Z ERROR authenticator::widgets::accounts::add::imp: Failed to load from QR Code file: Invalid OTP uri format, expected otpauth, got phonefactor

As I understend this error message: QR code I got can only be used with smartphone app and Authenticator GNOME app is not meant to replace Microsoft's Android Authenticator app but some other Microsoft MFA service?

I don't have Android nor IOS smartphone, I don't use Windows either. Is it possible to use this MFA service with Linux?

2
  • If you're not dead-set on the push-notification method you can always use something like authy ...
    – tink
    Oct 2, 2023 at 4:23
  • 1
    You seem to be conflating the technology, the service and the client implementation.
    – symcbean
    Oct 11, 2023 at 10:11

3 Answers 3

1

I do not know any specifics about Microsoft way to doing 2FA, however it seems that Microsoft Authenticator App may use a proprietary protocol or algorithm that is not compatible with standard TOTP apps. Additionally Microsoft 365 administrators are able to, and are being encouraged to, enable options for not allowing standard TOTP. I am experiencing this now when my existing TOTP stopped working and only form of accepted 2FA is Microsoft Authenticator App on iOS or Android. In my case even hardware keys are no longer allowed and no other options are available to me. If standard TOTP is not disabled by your administrators yet, you should be able to go under "My Account" and under Security and add "Other" type of 2FA which is TOTP and will work with any app. If the option is disabled this will not be present at all, and your only choice is to install the MS app on an Android or iOS device.

Correction and additional info: You can see the "I want to use a different authenticator app." link when you are trying to set this up, and this will allow you to use any TOTP app. If this link is missing, then you are not allowed to use anything else. Here is the Microsoft doc with screenshot: https://support.microsoft.com/en-us/account-billing/set-up-the-microsoft-authenticator-app-as-your-verification-method-33452159-6af9-438f-8f82-63ce94cf3d29

1

usually a normal TOTP is used as MFA resp. 2FA. since it is an open standard, it is completely pointless which app you use to store the seeds and generate the TOTPs.

if you are looking for a mobile linux app have a look at these: https://linuxphoneapps.org/categories/multi-factor-authentication/

there are also (desktop) password safes (like KeePassXC), which are able to store TOTP seeds and generate the TOTPs for you... but be aware, if you store your password and the TOTP seed at the same place, you counteract the MFA! especially if you have your password safe or more precisely the database not secured with more than one factor.

here is also their guide to add TOTPs to your database: https://keepassxc.org/docs/KeePassXC_UserGuide#_adding_totp_to_an_entry
if you have issues finding the seed in clear text, just use something like QtQR to scan the QR code and extract it manually.

0

I am investigating this as well, for similar reasons.

I ended up installing an Android-x86 VM and setting up the Microsoft Authenticator app in that.

That does work... But it is a bit clunky and awkward.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .