Hacker News Reader

Comment by belltaco | Hacker News Reader

> I have already had several malicious login attempts

Doesn't that mean they know your username and password? How does that happen so easily.

The last time I used Microsoft Authenticator (which was quite a few years ago), I noticed it would send me a request regardless of whether the correct password was entered or not. I suppose this is one of those "security by obscurity" type measures where they don't want to reveal whether the password was correct or not before MFAing. However, this results in non-stop requests because every few hours someone somewhere in the world attempts to penetrate my MS account.

This became so tiresome that I disabled MFA. Here's a hot take: if your MFA solution fatigues people to the point they disable MFA, you have a problem.

Also, I'm wondering if the OP might be referring to passwordless "Approve this login request" notifications rather than plain old MFA, where someone just needs to enter your email address and hope you approve the login request. Not sure if MS does this, but I know other apps that do.

MS still has not solved the notification fatigue but now the SSO gives you a 2 digit number you need to insert in the app.

This solves the problem of accepting the wrong login by mistake

The line you quoted doesn't mean they know the password. But this one does:

> Fortunately I'm attuned enough to decline them.

There is only something to decline if they know your password.

I assume this is referring to the passwordless logon feature, which most enterprises disable. But with this feature, you just need to enter the username (email address) and choose the option to log in with authenticator.

Regarding MFA-fatigue, this is mitigated by asking the user to enter the same number into Authenticator that is displayed on the login screen. So that takes away the chance of accidentally approving an MFA prompt.

They said login attempt, not successful login. So no.

But to get to the auth request, do you not need to pass the password stage first?

I get these pretty frequently on my work machines as I reuse my passwords and they have already leaked. At least that was my assumption.

Since they talked about the authenticator app, it depends on how it's set up. You can enable it for passwordless logins, so you'd get the prompt for knowing the account name.

Reply on news.ycombinator.com