My wife worked for the government.

When they deployed wfh, they used mfa. They banned Google authenticator out of the view Google can't be trusted. But told people to search the app store for any other mfa app. They one my wife found makes you wait for an ad run before it displays the code. It sometimes crashes and is generally terrible.

The point being banning certain apps seems far more political than well thought out.

Sorry, their official MFA policy was "just go find a random one"? How would that even work? Do they have a contract with every MFA service?

I would presume a random TOTP app. Incredibly stupid policy nonetheless.

Yes that was the official policy. I was in such disbelief I made her show me the official guide she was given. Of course im sure they had no contracts anywhere, it looked like someone simply said "google will sell your data" and someone senior bought it and banned one app.

> How would that even work?

TOTP is a standard (https://www.rfc-editor.org/rfc/rfc6238), so I don't see how that wouldn't work.

It wouldn't work if the app implementing TOTP decided to share the seeds you stored in it.

Let's just assume that not ALL government agencies employ rocket scientists.

> Sorry, their official MFA policy was "just go find a random one"? How would that even work? Do they have a contract with every MFA service?

TOTP is a standard, so anyone can implement it.

https://www.rfc-editor.org/rfc/rfc6238

Authy is good, or freeotp if you want to go full FOSS.

Duo Mobile on iOS lets you save and restore your TOTP tokens across iPhone backups with a symmetric passphrase. It provides some peace of mind in the event you would lose your phone.

I find it very sad that the government isn't even capable of writing its own presumably TOTP authenticator app.

I am not sure why tiktok would be on a state owned device in the first place. Why not grindr!

Exactly. Most state governments have competent enough IT that they use a corporate AppStore to deploy software to phones.

This is just a way to get the governor’s name out there as a VP candidate. Taking an anti-China stance sounds tough and decisive. She was pretty good getting her name out during COVID.

I would think they would implement a whitelist rather than a blacklist.