Microsoft Authenticator watchOS app to be discontinued in January

AppleInsider

If you use the Microsoft Authenticator app on your Apple Watch, be prepared to look for an alternative starting January 2023.

Yet another companion app is leaving the Apple Watch, and this time it's the two-factor authentication app, Microsoft Authenticator.

In a support post spotted by 9to5Mac, Microsoft confirmed that a new update to the Microsoft Authenticator iOS app will cause the watchOS companion app to quit working.

Microsoft suggests that anyone who currently has the watchOS app installed to delete it, as it will be nonfunctional sometime in January.

According to Microsoft, watchOS is incompatible with Microsoft Authenticator's security features.

Of course, anyone who needs to use Microsoft Authenticator to access their Microsoft account will still be able to use the app on iPhone or iPad -- it's only Apple Watch that is affected.

This marks another app that is quietly leaving the Apple Watch. In 2017, Google pulled its companion Google Maps app, but later reinstated support for it in 2020.


While eBay introduced its watchOS app in 2015, it removed it in 2017.

In 2018, enterprise messaging platform Slack depreciated its Apple Watch app.

In 2019, Niantic pulled the Pokemon Go companion app from the Apple Watch less than three years after it was introduced.

Read on AppleInsider

itguyinsd

This makes no sense.  All of the sudden WatchOS is insecure?  I've been using my watch to acknowledge Authenticator requests for a long time and never an issue.
This isn't a show-stopper but it is annoying that I have to have my iPhone next to me to use Authenticator now (and not really being told why...)

bestkeptsecret

With respect to all the apps that are quitting the Apple Watch, is it a return-on-investment thing? Apps like eBay and Slack make sense on the Watch. It's a pity to see all of them disappear.

entropys

Darn it, that was one of the reasons I had for justifying an Apple Watch.

all down to developer resourcing I suppose. Every Apple Watch owner that would use Authenticator already has to have the app on their phone anyway.

edited December 2022

chadbag

All the systems I use that require an authentication app work with multiple ones, including work which uses MS stuff.  There are other authenticators that still have watch apps. 

22july2013

I'm not sure what features Microsoft Authenticator provides, but my guess is that the features of Microsoft Authenticator app for watchOS overlap with the new Passkeys feature that Microsoft, Google and Apple are now rolling out for each of their OSs.

avon b7

22july2013 said:

I'm not sure what features Microsoft Authenticator provides, but my guess is that the features of Microsoft Authenticator app for watchOS overlap with the new Passkeys feature that Microsoft, Google and Apple are now rolling out for each of their OSs.

You can set up two factor authentication to use a time limited code number through an authentication app. 

I use Microsoft Authenticator for my NAS access. I log on with the admin name and password and then it asks me for the authentication code generated through the app.

To access to the authentication app I obviously need biometrics or a PIN code too. Once I've got into the app I choose which device I want the code for and it is generated and valid for a few seconds. It renews automatically. 

A watch app simplifies things so those users will be disappointed. 

xbit

Pity. This is one of the few third-party watch apps that I use on a regular basis.

daalseth

Open question; 
What was this used for? I work on a remote system using Microsoft Remote Desktop. I log into it using an app called Duo, that also logs me into my Microsoft account.
if I don’t need Authenticator to do that, what was it used for?

avon b7

DAalseth said:

Open question; 
What was this used for? I work on a remote system using Microsoft Remote Desktop. I log into it using an app called Duo, that also logs me into my Microsoft account.
if I don’t need Authenticator to do that, what was it used for?

It's for two factor authentication. A second layer of protection.

I'm supposing that in your current setup, if someone got hold of your username and password, they would have access to your account (although you may get message saying a new device had logged into your account). Or perhaps you have 2FA through a different means. 

dewme

DAalseth said:

Open question; 
What was this used for? I work on a remote system using Microsoft Remote Desktop. I log into it using an app called Duo, that also logs me into my Microsoft account.
if I don’t need Authenticator to do that, what was it used for?

Microsoft Authenticator is a general purpose 2FA app that can be used with a number of sites once it’s registered with the sites in question. I use it for Google, VMWare, Firefox, Slack, and a few more sites. It’s not exclusive to Microsoft. These authentication apps basically make your device function like a hardware key. The 2FA process is based on two things, 1) something you know and 2) something you have. The “know” part is your password and the “have” part is something that you must have physical access to when prompted, be it a device with an authentication app or a physical hardware key like a YubiKey. (Note: this is very oversimplified)

I’m very curious to see how PassKeys will impact the 2FA landscape. 

edited December 2022

avon b7

dewme said:

DAalseth said:

Open question; 
What was this used for? I work on a remote system using Microsoft Remote Desktop. I log into it using an app called Duo, that also logs me into my Microsoft account.
if I don’t need Authenticator to do that, what was it used for?

Microsoft Authenticator is a general purpose 2FA app that can be used with a number of sites once it’s registered with the sites in question. I use it for Google, VMWare, Firefox, Slack, and a few more sites. It’s not exclusive to Microsoft. These authentication apps basically make your device function like a hardware key. The 2FA process is based on two things, 1) something you know and 2) something you have. The “know” part is your password and the “have” part is something that you must have physical access to when prompted, be it a device with an authentication app or a physical hardware key like a YubiKey. (Note: this is very oversimplified)

I’m very curious to see how PassKeys will impact the 2FA landscape. 

I think it will probably make 2FA less important except for areas where you want access to your local or iCloud Keychains. I suppose you'd have to have 2FA for that but I haven't dug into the details on the passkey thing. 

daalseth

avon b7 said:

DAalseth said:

Open question; 
What was this used for? I work on a remote system using Microsoft Remote Desktop. I log into it using an app called Duo, that also logs me into my Microsoft account.
if I don’t need Authenticator to do that, what was it used for?

It's for two factor authentication. A second layer of security.

dewme said:

DAalseth said:

Open question; 
What was this used for? I work on a remote system using Microsoft Remote Desktop. I log into it using an app called Duo, that also logs me into my Microsoft account.
if I don’t need Authenticator to do that, what was it used for?

Microsoft Authenticator is a general purpose 2FA app that can be used with a number of sites once it’s registered with the sites in question.

Well that’s what Duo does, 2FA. I log into my remote system on my Mac, and it pings my phone/AW for confirmation. There’s probably a reason the Sysadmins went with Duo rather than Authenticator, though I don’t know what it is.

Anyway, thanks. That clarifies things.

edited December 2022

darkvader

Well that's annoying.  I've only been using an Apple watch for a few months, but using that stupid authenticator app on it is more convenient than using it on the phone.

At least I don't have to use it all that often.

dewme

avon b7 said:

dewme said:

DAalseth said:

Open question; 
What was this used for? I work on a remote system using Microsoft Remote Desktop. I log into it using an app called Duo, that also logs me into my Microsoft account.
if I don’t need Authenticator to do that, what was it used for?

Microsoft Authenticator is a general purpose 2FA app that can be used with a number of sites once it’s registered with the sites in question. I use it for Google, VMWare, Firefox, Slack, and a few more sites. It’s not exclusive to Microsoft. These authentication apps basically make your device function like a hardware key. The 2FA process is based on two things, 1) something you know and 2) something you have. The “know” part is your password and the “have” part is something that you must have physical access to when prompted, be it a device with an authentication app or a physical hardware key like a YubiKey. (Note: this is very oversimplified)

I’m very curious to see how PassKeys will impact the 2FA landscape. 

I think it will probably make 2FA less important except for areas where you want access to your local or iCloud Keychains. I suppose you'd have to have 2FA for that but I haven't dug into the details on the passkey thing. 

Like you, I'm not totally clear on PassKeys but from what I've read on the topic it seems like a more seamless and integrated 2FA model that piggybacks on top of the secure device-based biometric authentication methods already provided by the device, like Face ID, Touch ID, Windows Hello, etc. This reminds me of how third party apps on my iPhone, iPad, and Mac can use Face ID and Touch ID to authenticate with a third party app or web site. I use this with 1Password and MyChart and it's a heck of a lot easier to use than the one-time-passcode (OTP) methods that require you to open the authenticator app and search for the OTP for the app/site that just prompted me for a code. I'm assuming the PassKeys that Apple, Google, et al are moving towards are an extension and standardization of this easier to use 2FA model.

filemakerfeller

dewme said:

DAalseth said:

Open question; 
What was this used for? I work on a remote system using Microsoft Remote Desktop. I log into it using an app called Duo, that also logs me into my Microsoft account.
if I don’t need Authenticator to do that, what was it used for?

Microsoft Authenticator is a general purpose 2FA app that can be used with a number of sites once it’s registered with the sites in question. I use it for Google, VMWare, Firefox, Slack, and a few more sites. It’s not exclusive to Microsoft. These authentication apps basically make your device function like a hardware key. The 2FA process is based on two things, 1) something you know and 2) something you have. The “know” part is your password and the “have” part is something that you must have physical access to when prompted, be it a device with an authentication app or a physical hardware key like a YubiKey. (Note: this is very oversimplified)

I’m very curious to see how PassKeys will impact the 2FA landscape. 

I have some concerns; basically the private keys for encryption are now on an individual's device rather than the servers of the service provider. Much less risk for the service providers, but if some nefarious actor gains access to your phone your entire digital life is toast. The risk to the entire population is reduced because the breach of a single device/network no longer yields potentially millions of credentials, but my gut feeling is that the risk to the individual has suddenly gone up beyond the point where most are capable of defending themselves.

It might be needless worrying, I haven't delved deeply into the implementation details to see if there are protections in place. But at the conceptual level, I am troubled.

filemakerfeller

Authenticator had a Watch app???

I don't know whether I'm more upset because they're cancelling it or because I never got the chance to use it. 

seanj

Meh, I never infect any of my Apple devices with MicroShit apps 

exceptionhandler

I only accidentally had the Authenticator app on my watch.  Work required it installed on my phone.  I would get dinged to authenticate on my phone from my watch.  The few times I responded on my watch it always said I’d have to complete it on my phone.  At best for me all it did was notify me to do something on my phone and wasn’t really all that helpful.  Not surprised to see it disappear.

The PassKeys reminds me an awful lot of ssh keys.  They are cryptographically secure using asymmetric keys.  Lose the key, you have to generate a new pair and get it registered with the remote servers.  Need access from multiple client machines? You’ll need to copy your key to those systems.  If someone gets a hold of your key, they are effectively you.  It sounds like iCloud takes care of syncing your encryption key across devices, however, I don’t think it has a good solution if the encryption key is intercepted.  At best, there will probably be a way to invalidate a key pair, but that presupposes that you know your keys were compromised.  By the time you know that the damage may already be done.  2FA could be used to mitigate this, but key pairs and OTPs are both “something you have”, which is not true 2FA.  It would need to include “something you know” (a password) or “something you are” (biometrics).

appleuseryeah

ITGUYINSD said:

This makes no sense.  All of the sudden WatchOS is insecure?  I've been using my watch to acknowledge Authenticator requests for a long time and never an issue.
This isn't a show-stopper but it is annoying that I have to have my iPhone next to me to use Authenticator now (and not really being told why...)

++++++

my response?

The problem is trusting the scum at Microsoft. They had a watch, they blew it. If you use Microsoft, watch out - they're a bloody disgrace. 

Bill gates needs to be arrested, and Sitdown Nutella is one of the worst CEOs - Microsoft is worse than ever under his greedership. 

edited December 2022

appleuseryeah

avon b7 said:

22july2013 said:

I'm not sure what features Microsoft Authenticator provides, but my guess is that the features of Microsoft Authenticator app for watchOS overlap with the new Passkeys feature that Microsoft, Google and Apple are now rolling out for each of their OSs.

You can set up two factor authentication to use a time limited code number through an authentication app. 

I use Microsoft Authenticator for my NAS access. I log on with the admin name and password and then it asks me for the authentication code generated through the app.

To access to the authentication app I obviously need biometrics or a PIN code too. Once I've got into the app I choose which device I want the code for and it is generated and valid for a few seconds. It renews automatically. 

A watch app simplifies things so those users will be disappointed. 

Microsoft is well versed at disappointing people.