0

tl;dr: I have switched phone and operating system: Android 8.0 --> Android 10.0. Phone restored from backup, so all the remaining is the same except for Microsoft Authenticator that now requires fingerprint scan. Does this truly increase security? Or is this only an irritating addition?

I have crashed my phone, but changed it to nearly identical. I have the same:

  • family: Motorola Moto Z2 Play → Motorola One,
  • hardware: both phones equipped with fingerprint scanner,
  • software and settings: new phone "recovered" from Google cloud backup.

The only change is system version: Android 8.0 → Android 10.0.

When I am accessing my Office 365 apps, I have to go through 2FA: Microsoft Account login + Microsoft Authenticator approval.

Under Android 8.0 I had to:

  • slide down notification area to reveal "Approve" shortcut button,
  • tap that button.

And I was authenticated and had access to my Office 365 apps.

Under Android 10.0 I now have to:

  • tap that notification (because sliding down does not reveal any shortcut buttons; notification type change?),
  • tap "Approve" button in presented popup window,
  • touch my fingerprint scanner's sensor.

Why this change? Does adding additional step of using fingerprint scanning comes from:

  • Android 10.0,
  • Microsoft Authenticator version available for Android 10.0,
  • my company policy change after I have registered Android 10.0's phone
  • or something else?

Does this really increase security in anyway? Should I consider my authentication access under Android 8.0 less secure, if I wasn't required to touch fingerprint scanner's sensor when authenticating there?

Or maybe the entire question is based on a false assumption. That was a company policy change that changed in exact day when I crashed my phone. And I would be forced to use fingerprint scanner under Android 8.0 as well from that moment on, provided that I would not crash my phone?

Improve this question
4
  • Do you also have to scan fingerprint when opening the app?
    – defalt
    Dec 10, 2020 at 6:49
  • Yes! I see "Authenticator locked. Use fingerprint or PIN to unlock it". And that is another thing that is new here, under Android 10.0. I am more than sure that I could open up Microsoft Authenticator under Android 8.0 without that. I am more than sure that I have never used my fingerprint scanning through my entire usage of Microsoft Authenticator under Android 8.0.
    – trejder
    Dec 10, 2020 at 7:06
  • 1
    "Does this really increase security in anyway?" - For sure! Earlier, if you left your phone next to the computer, someone could have approved the authenticator on your behalf. Now at least it knows that its the same person that set up the authenticator app, right?
    – Limit
    Dec 10, 2020 at 16:11
  • in my mind this is mostly on the convenience side of convenience vs security. It can be faked, and since you can't really change your fingerprint, you'd be compromised forever.
    – pcalkins
    Dec 10, 2020 at 19:36

1 Answer 1

Reset to default
1

It does increase security of your Microsoft Authenticator account. In android, apps can use TEE (Trusted Execution Environment) to encrypt authentication token and secrets. When a user wants to login, app requests for biometric or PIN authentication backed by TEE. If authentication succeeds, TEE decrypts authentication token for account login and other data that app wants it to be tamper-resistant and secret.

In most cases, TEE actually decrypts the key that encrypts app's sensitive data. In this way, apps get little more control on when and what they want to decrypt.

Microsoft Authenticator might be using biometric authentication for account login and account holder verification. Verifying the account holder is common in banking apps and it is as much useful for password managers and TOTP generators. Another purpose app based authentication serves is physical theft when the device is unlocked. There's no workaround to infiltrate the app if the authentication is backed by TEE. Reinstalling the app or clearing app data flushes app's associated key(s) in TEE as well.

As for android version, there's no justifying reason to enforce biometric in android 10 but not in android 8. Apps are backward compatible with previous android versions and the minimum android version to support is set at build time. But apps can show and hide some features based on android version. From Android 8+ onwards, biometric authentication is supported and backed by TEE. However, there have been improvements in hardware backed keystore and biometric authentication in each successive android version. It could be that the developers didn't test biometric authentication for android 8 or it wasn't enabled by default in that version.

Improve this answer
1
  • Thank you for your answer. I have upvoted and accepted it as it explains everything. Let me only add that I have got a confirmation from my company security departament that fingerprint or PIN usage on Microsoft Authenticator is a must across all devices and Android version. So the fact that I was not enforced to use it under Android 8.0 clearly suggests that there is an error in Microsoft Authenticator implementation. Either the whole line of A8 or just the one running on my Motorola.
    – trejder
    Dec 11, 2020 at 7:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .