Hacker News Reader

Comment by ttul | Hacker News Reader

This is why you have to give the enduser a way of authenticating the authenticator. The well-designed Adobe Account Access app often presents the user with a random number that they have to tap on in the authenticator app. The authenticator app presents that number along with some other random numbers, asking the user to pick the correct one.

The random number list is not always presented. I presume that Adobe skips presenting the number challenge if the user is logging in with a relatively fresh cookie or from a recently associated device. But I guarantee that login attempts from a new device would prompt this more strict authentication step.

Microsoft now appears to do this (thank you, Traubenfuchs).

View on HN

My bank used to show me a picture that I specified, after I put in my username, but before I put in my password. I knew that if I was being shown an odd picture, I either typed in my username incorrectly, or I was not logging into my bank!

I think would make scams more obvious, even in the face of MFA fatigue!

Surely an attacker can just proxy this? Seems like security theatre to me.

This is for phishing attacks with lookalike domains and sites. Pretty common in the web banking world.

Yes but I'm pretty sure the lookalike domain proxy your username and the "security picture" back to the real domain to make it look legitimate.

The software to do it is even available on GitHub IIRC. Purely for research purposes of course.

We know how to actually fix this, apparently people don't want to :(

Yep. This is kinda useful as an indicator whether you wrote login correctly (wrong pic = wrong login) and to weed out the lowest quality phishing, but for anyone who's not a clown it should be easy to recreate the flow and hence, it's actually even harmful (you think you get assurance you're not scammed while getting scammed).

Edit: one thing to make it more bulletproof would be bank rejecting all calls that look like serverish initiated (AWS etc), then the attacker would need some genuinely looking botnet to not get blocked by the bank due to suspicious volume from same IP pool. Raises the bar for attack, but still, serious attacker can mitigate this.

They only show the picture after you have logged in successfully from the device. If it is a new device (or attacker), the picture is blank and the site says something like “first time using this device?” So it helps against phishing or a MITM that doesn’t intercept the real site cookies.

Generally the attack vector is much easier: Just replace the image with a "This service is currently being upgraded for your safety!" or whatever. Most people in studies I've seen will still go through with the login.

Yahoo used to do this, called Yahoo! Sign-In Seal. Not sure if they still do it.

Anyone remember which set of keys they had? https://security.stackexchange.com/questions/41247/changing-...

Microsoft Authenticator does that. Outlook.com logins need you to press the right number in Microsoft Authenticator.

That's actually shown in the article as a mitigation strategy

But enterprise users don’t!

The more important the system, the worse Microsoft’s MFA security is.

Their strongest protection is for XBox accounts.

Because they know that their users value their personal Minecraft skins more than billions of dollars worth of their employer’s stuff.

That's not it at all. Its difficult to get buy in on stricter security practices in an organization because people dont like to be hassled. Enterprise security is always a balancing act with user inconvenience.

Microsoft can get away with it in Xbox because they can set the terms for how an individual gets to access the service.

An individual consumer doesn't have much of a choice but trying to force the same terms on business users could cause them to not use it at all or jump vendors.

Enterprises have very fine-grained ways to manage the 2fa flow. My AAD-based account requires I type in the full number on the Authenticator app; not choose from 3 numbers.

https://docs.microsoft.com/en-us/azure/active-directory/auth...

Use number matching -- Preview

Use additional context -- Preview

Awesome. Let me just convince my enterprise customer where I'm not even an employee to mass enable two PREVIEW features for 35K users. That'll go down well.

Users cannot opt in to more secure authentication options individually.

The default is woefully insecure, almost pointless security theatre.

The secure option is unsupported in production.

Hardware token-based security is disabled by default, and carefully hidden behind dark patterns to boost the numbers of the MS Authenticator app so that some manager at Microsoft can meet his personal KPIs and get his bonus.

Customers using features like Azure AD multi-tenant applications cannot enforce MFA themselves -- Microsoft reserves this capability for their own applications only.

Even if I enforce hardware token MFA in my own personal Azure AD tenant, if I get invited to some other tenant as a Guest (e.g.: to a Teams meeting), then I'm forced to sign in using their MFA policy, which is more than likely the default MS Authenticator app with all optional features like this disabled.

To say that Enterprise customers have lots of options is patently false.

Microsoft only cares about security when it affects their own systems.

> Microsoft only cares about security when it affects their own systems.

I don't think even that's true. Unlike at Google and to some extent Apple, I don't sense that Microsoft's internal corporate culture wants security per se. Both Google and Apple seem comfortable with the idea that if you can solve a security problem for $15 you have one option, "Secure" and it costs $15 and the only question is whether "Not secure" should be available for $0 (OK at Apple maybe "Secure" inexplicably costs $30 because it's a premium product but equally maybe "Secure" was "free" with your $1000 premium Apple product, for this argument either outcome is fine).

Microsoft seems excited about offering "Somewhat secure" for $5 and "A bit more secure" for $10 and if just "Secure" is an option at all, it needs to be priced at $100 to show what a bargain the "Somewhat secure" option is. This is a reasonable mindset if you make padlocks or something, but a crummy attitude for digital security where we can so often just solve the problem full stop. Remember how Intel couldn't persuade people the Pentium FDIV bug wasn't a big deal? Nobody wants a computer that sometimes gets arithmetic wrong "a little bit" they want the correct answers and anything less is unacceptable.

> Because they know that their users value their personal Minecraft skins more than billions of dollars worth of their employer’s stuff.

Or because the XBox team isn't beholden to corporate clients, so they're much more free to make changes which affect user workflows.

You can definitely use this in some enterprise contexts. This is what I usually do for logging into Azure.

Google does that as well.

Reply on news.ycombinator.com