Microsoft’s 2FA implementation does not help because it allows attackers to guess the password first and the second factor next. They just don’t get it.
In fact I have Security Keys, so, now you're trying to break AES, which you can't do.
But let's suppose you're attacking the average person whose second factor is a TOTP authenticator. Unsurprisingly Microsoft only give you a finite rate of tries at TOTP codes. And of course the correct code keeps changing meanwhile, so you can guess forever and never have better than about 1 in a 100 000 chance to guess a valid code each time. How many guesses do you think you get before your client is considered vexatious and can't try any more?
And how do you know the attacker is one client? He can just be 1000000 clients each only trying once. And if you block them you also block the user.
Either that, or you force the user to do a password reset if ever they provide the password but cannot provide the 2nd factor in the same login attempt. I think that would upset a lot of users though.
Having two factors is better. But obviously neither of them should be a conventional password because passwords are crap.
You can have WebAuthn set to do usernameless authentication, with the two factors both being local. So when you visit a site with this behaviour and it wants authentication, you maybe touch your fingerprint sensor on your phone, that's one factor, having the phone is the other factor, that's two factors, the phone hands over credentials including a large identifier that's equivalent to a user ID for the site, plus its assurance that you are present (based on the fingerprint) and a signature proving it is still the same phone used to sign up for this method. No typing your email address, no passwords, much better security.
> He can just be 1000000 clients each only trying once. And if you block them you also block the user.
Yes, if you rate limit attackers you also rate limit the real user.
But as an attacker, what value am I getting from that? Maybe it's a chargeable service I can sell? It certainly doesn't help me steal gift cards.
$1000 per hour to annoy a friend by preventing them from logging into their email? Not many buyers at that price. $100 per hour? $10 per hour? $1 per hour? Remember that to fuel this you are throwing away a botnet so that you can hammer on the login until you get blocked, and botnets aren't that cheap to buy.
Yes you can have proper security. But this is about the Microsoft solution where you don’t, where you can first guess the password and then guess the 2fa code. Which is not very smart, considering it’s not that much harder to check both at the same time and fail when either is wrong.
You can't do that. Try to imagine what this looks like:
You're at the Microsoft login screen. Microsoft needs you to present both a password and...
* WebAuthn sign-in credentials, for which it must send data to your client
* a TOTP code, from the authenticator you may or may not have
* the SMS code, which you er... wait, what SMS code, how can Microsoft send it to you if you didn't say who you are?
* the email code, which again er... Microsoft can't send this until it knows who you are
OR
* any other technology Microsoft adds later which may require any of the above or something else.
So the effect here is this gives bad guys a free targeting feature. Just type in any email addresses and Microsoft will tell you which 2FA is enabled if any.
> And of course indeed it doesn’t work with methods like sms and emailing codes
So, it doesn't help at all for the good case, and it breaks the bad case worse, what was the goal again?
I mean if there's repeated login attempts where the password is correct but the 2FA is not that's a pretty good indication that the password may be compromised. I'd like to be notified of that.
Up until recently SMS 2FA could be broken for $10 because one VOIP provider allowed number registration on any number.
If you can filter 10,000 accounts down to 100 with known passwords, now you just have to bypass 2FA on 100 accounts.
It used to be this didn't have any real backend checks, so you could effectively steal someone's number, at least temporarily.
Surely not?
From 2021:
https://www.vice.com/en/article/y3g8wb/hacker-got-my-texts-1...
EDIT: yea it's not 'registering' the number but rather rerouting a copy of all messages to another number.