Hacker News Reader

Comment by YPPH | Hacker News Reader

My work uses Microsoft SSO for everything. Passkeys aren't enabled though. And management won't enable them on Azure AD. Instead, they enable the tried and tested and ultra secure method of SMS based 2FA with a password. (This is sarcasm.) The alternative is the Microsoft authenticator app with its associated risk of approval fatigue. I have already had several malicious login attempts. Fortunately I'm attuned enough to decline them.

The only way I'll get passkey logins for my work account is if Microsoft force it as a 2FA method for enterprise. I won't hold my breath.

View on HN

> I have already had several malicious login attempts

Doesn't that mean they know your username and password? How does that happen so easily.

They said login attempt, not successful login. So no.

But to get to the auth request, do you not need to pass the password stage first?

I get these pretty frequently on my work machines as I reuse my passwords and they have already leaked. At least that was my assumption.

I assume this is referring to the passwordless logon feature, which most enterprises disable. But with this feature, you just need to enter the username (email address) and choose the option to log in with authenticator.

Since they talked about the authenticator app, it depends on how it's set up. You can enable it for passwordless logins, so you'd get the prompt for knowing the account name.

The line you quoted doesn't mean they know the password. But this one does:

> Fortunately I'm attuned enough to decline them.

There is only something to decline if they know your password.

Regarding MFA-fatigue, this is mitigated by asking the user to enter the same number into Authenticator that is displayed on the login screen. So that takes away the chance of accidentally approving an MFA prompt.

The last time I used Microsoft Authenticator (which was quite a few years ago), I noticed it would send me a request regardless of whether the correct password was entered or not. I suppose this is one of those "security by obscurity" type measures where they don't want to reveal whether the password was correct or not before MFAing. However, this results in non-stop requests because every few hours someone somewhere in the world attempts to penetrate my MS account.

This became so tiresome that I disabled MFA. Here's a hot take: if your MFA solution fatigues people to the point they disable MFA, you have a problem.

Also, I'm wondering if the OP might be referring to passwordless "Approve this login request" notifications rather than plain old MFA, where someone just needs to enter your email address and hope you approve the login request. Not sure if MS does this, but I know other apps that do.

MS still has not solved the notification fatigue but now the SSO gives you a 2 digit number you need to insert in the app.

This solves the problem of accepting the wrong login by mistake

> My work uses Microsoft SSO for everything. Passkeys aren't enabled though. And management won't enable them on Azure AD.

I don't think they're actually available on AzureAD. That thing tends to lag like crazy in actual security features. FIDO support is relatively newish. IIRC it was generally available around the end of 2022. Only recently, you no longer have to register a phone number for password reset (which is different from login, mind (SSPR)).

> they enable the tried and tested and ultra secure method of SMS based 2FA with a password

This isn't actually that much worse than the MS recommended way of using their crappy authenticator. They even allow passwordless sign-in with that thing! The prompt doesn't tell you anything useful apart from "login with <account>?". Now, at least, they prompt you for a number you see on screen. It doesn't help with phishing, but at least you know the request comes from what you're doing, not someone else, since it also tended to drop any request if another one was pending.

Oh right, thanks for clarifying that.

My employer uses the MS Auth app. Now when logging in, it shows a number on the screen that you have to type on the app and then use the finger print. Before it used to be the fingerprint only. Seems like a relatively effective way to ensure people are not just approving everything prompted by the app.

Does anyone know what's the intention in doing this? The default behavior of OTP was afaik always to generate a code on the second device, and input that into the device you are trying to log in with.

I assume Microsoft felt the need to dumb this down so it's easier to just approve it with a click of a button, then after they realized this is bad (that pretty much anyone with a bit of security experience predicted) they now changed this to "input code on second device", instead of just reverting to the default behavior.

Why?

All of these are options that your company chooses from. It's possible to have it just show an approve button, to have it show a selection of 3 numbers, or to show the number entry box. Whether or not you are prompted for your password on the device you're logging into is also a decision that your company makes.

Authenticator has options that avoid approval fatigue. There's a setting that causes it to show a number on screen, and then an option between providing a list of 3 numbers you have to pick from or showing a textbox that you have to type the displayed number into. If it's set up for textbox entry it's unlikely that someone is going to approve a random request.

Reply on news.ycombinator.com