Better late than never

Australian security consultant Brett Randall posted about the security hole over the course of several months and said he saw more than 100,000 views on those LinkedIn posts.

“This now brings Microsoft Authenticator back on par with other phone-based TOTP authenticators. It no longer allows the accidental overwriting of TOTP keys when certain conditions, including reused email addresses, are present, which was effectively locking users out of unrelated systems with little warning,” Randall wrote on LinkedIn. “Thank you, Microsoft, for fixing the issue, even if it was far harder than it needed to be to get an acknowledgement that the issue existed.”

Tim Erlin, API security leader at Wallarm, was one of many users last month who confirmed the Microsoft Authenticator issue. “Although it seems like it wasn’t easy to get addressed, it’s great to see that Microsoft has fixed this issue with their Authenticator app. There’s no doubt that it will prevent future headaches for their users,” Erlin said.