• 17 Posts
  • 207 Comments
Joined 1 year ago
cake
Cake day: March 2nd, 2023

help-circle






  • Not surprising. If there’s a way for a non-admin user to use this, it means there’s probably a way for a non-admin process to access the data.

    Even if if were more secure, there’s probably plenty of ways for attackers to escalate privileges to admin.

    The bigger issue is Microsoft providing an official tool for snooping on user activity. Malware won’t have to install their own, and recall taking screenshots periodically won’t be considered anomalous behaviour since it’s an official Microsoft service.





  • That’s the solution I picked at work. Refused to install that Microsoft software on my personal phone, but instead provided a phone number.

    If you have a VoIP provider you could even try to the VoIP number for MFA instead of providing your real mobile number.

    If IT make a comment about you not having the app, ask if they intend to provide a company device for that.