Everything Doesn’t Come Back

When most people get a new iPhone, they take it for granted that all their data and settings, etc. can be backed up to the cloud and then reinstalled on their new phones. Sorry, but that’s not always the case, and it will be a matter of greater importance when Microsoft makes you use the Authenticator app instead of SMS in your login process. It’s time to reset your thinking and the app.

Yes, it’s true that when you back up all your iPhone’s data to iCloud, you can have a high degree of assurance that your contacts, emails, photos, apps, etc. can be transferred from your old phone to your new one. But it’s not true for Microsoft 365 and the Authenticator app you need – or will need, come February – to access all your Microsoft accounts and shared workspaces, such as SharePoint.

In fact, SharePoint and the Authenticator app will require some special attention and planning once the Authenticator app is your only way to prove it’s you and your device that need access to the account. So, let’s reset your thinking on new iPhones, SharePoint and MFA. It’s important now if you’re planning on getting a new phone, and it will be critical in February.

Your best option is to call us to set up the Authenticator app on your new phone before you give up your old phone. It’s not always possible – if your phone dies or you lose it – but it makes life much, much easier. The process involves a lot of back-end work that’s all related to security. It’s work that Apple or your carrier won’t do when you activate your phone, and if you skip the step, you won’t be able to login to your Authenticator app without going through a complicated process.

When you have both phones, we can help you safely remove any sign-in methods linked to your old phone and re-register the app on your new phone. Because we do this a lot, we can make sure that no steps are missed as we go through all the on-screen prompts to link the app with your account.

Without having the old phone, you need to go through a number of administrative steps, which we can do if we are serving as your IT administrator. These include alternative verification steps that should have been set up. If they were set up with us, we should have the information available.

Whether you are getting a new phone or not, remember that starting in February, you won’t have SMS available as a backup for authentication. Therefore, it’s critical to make sure you have the most recent version of the Authenticator app on any device you will be using for SharePoint and other collaborative tools. If the app doesn’t work because it’s not properly registered, there is no way a SharePoint host, for example, will be able to allow you access.

We can help you and everyone on your team is able to transition seamlessly to a new Authenticator app with a new device. Call us – 973-433-6676 – or email us to make sure we can be available to help you re-register while you have your old and new devices. We can also answer any questions you may have to make sure your authentication systems work without interruption after SMS verification goes away.

Microsoft Demands Authenticity for Access

Microsoft will retire SMS (text messages) next February as a means of authentication for access to its accounts. I can imagine someone standing up in a meeting and saying: “We’re doing this for your own good.” It’s time to cut the phishing line.

Text messages can work as an authentication method, but the concept has vulnerabilities. It’s based on the assumption that when you get a verification code to authenticate your access, you have your cell phone in your physical possession. That’s true virtually all of the time. However, text messages are subject to SIM swapping, a technique hackers use to temporarily take over your phone number, and they can do it long enough to intercept the text without you ever knowing about it until something goes wrong.

There are also some locations in various cellular networks that are vulnerable to breaches, and it’s possible that a hacker can get access to the cellular network right as the text message is being sent to you.

If a hacker can gain access to a user’s Microsoft account while they’re logging in, they can gain access to contact lists and use them to launch phishing campaigns by email and text.

Authenticator apps bypass the cellular network. They generate a code from your phone, making them impossible to intercept. Many authenticator apps include additional security measures such as passcodes, passwords, or biometric authentication (like fingerprints or facial recognition), making it more difficult for unauthorized users to access your accounts even if they have your password.

This does force an issue, especially for businesses or other organizations that require employees to use their personal cell phones for business. Some employees fear their employers will be able to access their personal phones. That does NOT happen with an authenticator app. Instead, it will provide stronger security for remote logins.

If an employee leaves an organization, the authenticator app for that phone can be blocked by the employer.

To comply, we highly recommend that users have a fairly recent smartphone. Older devices may have problems running the app or require a time-consuming process to get them set up or install a backup process.

We can help any user set up an authenticator app on their phone. In most cases, it’s just a matter of walking someone through the process. Once it’s installed, it can be used independently of the employer for access to any website that offers it as an option to SMS authentication.

Call us – 973-433-6676 – or email us if you have any questions or need help setting up the app.

It’s Time to be Authentic

Getting a text (SMS) code to verify your access to a website is becoming increasingly vulnerable because of SIM swapping. It’s essentially a way for a hacker to “borrow” your mobile phone number without you ever knowing it – until you suffer the consequences. It’s time to use a better authentication method.

One of our clients was victimized by SIM swapping. We suspected a problem when none of their cellular devices worked. They used a family member’s phone to call us about the problem. We told them to get to the Apple Store immediately to buy new devices and bring them directly to us – without opening any boxes. Using special tools, we were able to set up all their devices securely, but the damage had been done.

How does SIM swapping work? It requires a fraudster to convince a mobile carrier to transfer your phone number to a SIM card they control. With your phone number, the attacker can intercept one-time passcodes and two-factor authentication (2FA) codes sent via text message, allowing them to gain access to bank accounts, which they can quickly drain, and social media and other sensitive online services.

The SIM swappers usually get your information through phishing expeditions, which are designed to trick you into revealing details like birthdates, full names, and addresses. Then, they pretend to be the account holder and claim their SIM card is lost or damaged, and they request to have your number “ported” to a new SIM card, which they have in their phone. Conceivably, they can access your bank account if your 2FA is a text message, clean you out, and wipe the SIM from their phone. You’ll only notice it when your phone doesn’t work – at which point you’ll contact your carrier, who will issue you a new SIM card.

You can prevent SIM swapping by not using SMS or text as an authentication method. Our recommendation is to use an authenticator app, such as Microsoft Authenticator or Google Authenticator. If you are signing into a website from your computer, the authenticator will send a code to your phone, and you’ll enter the code from your computer.

This is one area we strongly urge you to avoid shortcuts. There are a lot of authenticator apps available, but Microsoft and Google have a lot at stake in your security. Both have huge customer bases and publish a lot of apps.

An alternative to an authenticator app is a biometric, such as facial recognition (iPhones and other Apple devices) or a thumbprint (Android phones). As with an authenticator app, these measures are device-specific.

We can help you set up both an authenticator app and biometric authentication to replace an SMS message. Call us – 973-433-6676 – or email us to talk about it.