We Went Looking for an MFA App... Here's What We Found
- Alex Hughes
- 4 days ago
- 5 min read
Sometimes the most valuable cybersecurity lessons don't come from ransomware attacks or headline-making data breaches.
Sometimes they start with a perfectly reasonable customer question.
Recently, one of our customers asked us something many businesses have probably wondered themselves.
"Is there an authenticator app we can install on a computer instead of using a personal mobile phone?"
Honestly, it's a fair question.
Not everyone wants to use their personal phone for work, and where company-issued mobile devices aren't available, having an authenticator on a workstation seems like a sensible alternative.
So, rather than guessing, we did what we always do.
We started researching.
Little did we know, that search would become a perfect reminder of why you should never trust something simply because it looks official.
The Search Started on Microsoft's Own Website
Like many people would, we headed straight to Microsoft's Edge Add-ons marketplace.
After all, it's Microsoft's own marketplace.
It's easy to assume that anything listed there has already been thoroughly vetted.
One extension immediately caught our attention.
At first glance, it looked incredibly convincing.
It had everything most people naturally associate with trust.
Google's familiar Authenticator logo
A professional-looking product page
A "Verified Add-on" label
A five-star rating
A polished description
Available directly through Microsoft's marketplace
If you were in a hurry, you'd probably install it without thinking twice.
And that's exactly why we kept digging.
Looking a Little Closer
One thing years in IT teaches you is this:
The first impression is rarely the whole story.
Whenever we're recommending software to customers, especially software responsible for protecting business accounts, we don't stop at the product page.
We start asking questions.
Who made it?
Where does it come from?
Can we verify it?
That's when things became... interesting.
The First Thing That Raised Our Eyebrows
Curious about the "Verified Add-on" wording, we clicked it.
Instead of taking us to Microsoft or an official verification page, it directed us to a GitHub repository.
Now, to be absolutely clear...there is nothing inherently wrong with GitHub.
Millions of legitimate developers publish excellent open-source software there every day.
But if something appears to present itself as an official authenticator application, we'd expect a very obvious chain of trust.
Instead, we found ourselves looking at a public GitHub project.
That alone wasn't enough to dismiss it.
But it certainly encouraged us to keep investigating.
Also notice how on the right it says "Google Authenticator-like browser extension"...something is off.
Then We Started Noticing Small Details
Individually, none of these details prove anything.
Together, they reminded us why paying attention matters.
The Version Number
The extension was listed as Version 0.3.0.
For anyone unfamiliar with software development, version numbers often indicate how mature a product is.
Software beginning with 0.x.x is generally considered to still be in development before reaching a stable Version 1 release.
Does that make it unsafe? Not at all.
But if we're talking about software that stores authentication codes protecting business accounts, it's certainly something we'd want to know before recommending it.
The Developer Name
This was probably the most interesting discovery.
On the product page, under Developer, it reads:
Verified Add-on
At first glance, your brain naturally interprets that as Microsoft confirming the extension has been verified.
But look carefully. That isn't Microsoft's verification badge.
It's simply the developer name displayed on the marketplace.
In other words, the publisher appears to have named themselves "Verified Add-on."
Whether that was intentional or not, it creates a very convincing impression of legitimacy.
It's a brilliant example of how easily our brains fill in missing information. We see what we expect to see.
The Five-Star Rating
A perfect five-star review sounds reassuring. Until you notice something else.
There was only one review.
Now, we're not suggesting that review wasn't genuine.
It may well have been. But one review tells you very little.
It certainly doesn't carry the same weight as hundreds or thousands of independent users.
Yet many people never look beyond the stars themselves.
So... Was It Dangerous?
Here's the important part.
We're not saying this extension is malicious.
We're not accusing the developer of doing anything wrong.
We simply don't know.
And that's exactly the point.
Cybersecurity isn't about assuming the worst.
It's about verifying before you trust.
Everything we observed was publicly visible.
Nothing more.
Nothing less.
Why This Story Matters
If there's one lesson we'd like customers to take away from this experience, it's this:
Official-looking doesn't always mean official.
Today, attackers—and sometimes simply misleading software listings—rely on visual trust.
They know people look for:
Familiar logos
Professional branding
Five-star reviews
Official marketplaces
Well-written descriptions
Our brains naturally relax when we see those things. That's human nature.
But taking just a few extra minutes to investigate can make all the difference.
Our Advice Before Installing Any Browser Extension
Whether it's an authenticator app, browser extension or productivity tool, we always recommend asking a few simple questions first.
✔️ Who is the actual developer?
✔️ Is it the official publisher?
✔️ Are there plenty of genuine reviews?
✔️ Is the software mature and regularly updated?
✔️ Does the website link where you'd expect?
✔️ Would your IT provider recommend installing it?
These checks take minutes.
Recovering from compromised accounts can take days, maybe even weeks.
Why Having an IT Partner Matters
One of the biggest parts of our job isn't fixing problems, it's stopping them from happening in the first place.
Our customer simply asked whether they could use an MFA application on their desktop.
Instead of recommending the first result we found, we investigated.
We questioned it.
We verified it.
Because that's what good IT teams do every single day.
Most of the time, our customers never see that process.
They just receive a recommendation they can trust.
And honestly?
That's exactly how it should be.
The Bigger Lesson
The internet has never been more convincing.
Fake emails look real. Fake login pages look real. Browser extensions can look real.
Even software hosted on official marketplaces deserves a second look.
Healthy scepticism isn't about distrusting everything.
It's about asking one more question before clicking Install.
Sometimes, that extra minute is the difference between staying secure and learning the hard way.
People Also Ask
Is it safe to download browser extensions from Microsoft's marketplace?
Microsoft's Edge Add-ons marketplace is generally safer than downloading extensions from unknown websites. However, users should still verify the publisher, reviews and overall legitimacy of any extension before installing it.
How can I tell if a browser extension is legitimate?
Check who published the extension, whether it comes from the official developer, how many genuine reviews it has, when it was last updated, and whether it links to an official website. If you're unsure, ask your IT provider before installing it.
Should I trust five-star reviews?
Not always. A five-star rating based on one or two reviews doesn't provide the same confidence as hundreds of independent reviews. Always look beyond the average score.
What should I look for before installing an MFA app?
Choose an authenticator app from a trusted developer, verify its publisher, review its permissions, check how actively it's maintained, and ensure it aligns with your organisation's security policies.
Why is it important to research software before installing it?
Installing unverified software can expose your business to unnecessary security risks. Spending a few minutes checking the publisher, reviews and legitimacy of software can help protect your accounts, devices and company data.
