Why does Microsoft Authenticator show email domain when using email as label rather than the Issuer?

user_2682623 0
Viewed 156

I am using TwoFactorAuth.net to show a QR code for scanning into an authenticator app. This works if I use a name in the "label" parameter. However, if I use an email address as the "label" in creating the QR code, Microsoft Authenticator uses the domain from the email as the Issuer, rather than the provided issuer.

To wit: EX 1 - Not Email (i.e. sample code):

  • private readonly TwoFactorAuth tfa = new TwoFactorAuth("MyCompany", qrcodeprovider: new QRCoder.QRCoderQRCodeProvider());
  • Model.GetQrCodeImageAsDataUri("Bob Ross", (string)Session["secret"])"

RESULT: NameLabel

EX 2 - Email Label:

  • private readonly TwoFactorAuth tfa = new TwoFactorAuth("MyCompany", qrcodeprovider: new QRCoder.QRCoderQRCodeProvider());
  • img src="@Model.GetQrCodeImageAsDataUri("mypaint@thebobross.com", (string)Session["secret"])"

RESULT: EmailLabel

However, the email DOES work properly in Google Authenticator: GoogleAuthenticator

Any ideas?

authenticator google-authenticator
1 Answers

Here's the standard Key Uri Format:

otpauth://TYPE/LABEL?PARAMETERS

I couldn't find any substantial information on how Microsoft Authenticator parses otpauth URI but after testing different ways I have come to the conclusion that if an email address alone is given as a LABEL, Microsoft Authenticator picks the subdomain of whatever TLD is present. Actually, Wiki also says different parts of a domain name are called labels so probably that's the logic there.

Anyway, I solved it by adding Issuer before the email address as LABEL (mind the ':' separator).

"MyCompany:mypaint@thebobross.com"

I've successfully tested this with Microsoft and Google Authenticator. Both show MyCompany as LABEL.

user_136283300
Related