Hacker News Reader

Comment by xenophonf | Hacker News Reader

This is how I'm going to describe that attack where you get a zillion authenticator push notifications because Microsoft has designed the damn thing to authenticate you to them but not them to you. Like, how freaking difficult would it be to put a transaction code in there like Apple so that you can match the notification on your phone with the session you're starting on some other device or service?!

View on HN

I thought they already have that? When trying to sign in to a Microsoft service it displays a number which I have to type in to the Microsoft Authenticator before I am able to confirm the sign in attempt.

You only get the push notification, no session binding, when using Microsoft Authenticator in other scenarios. That's if you get the push notification. It's variable in my experience. (I use it as a backup MFA method when I don't have my badge reader handy.)

> It's variable in my experience

It shows you a code when the initiator is an unfamiliar device, but doesn't show you the code when the initiator is a familiar device. You can reproduce this fairly easily - open a private tab and try to login - you'll see the code in your app. Then logout and login again without closing the tab - you won't see the code.

Which actually makes sense, if not well-explained to users.

I just wish Microsoft would let me use any other authenticator app instead of their garbage one. So now I've got one from Google with 99% of my accounts on it, one for Microsoft for one of 4 MS accounts, and one for the USG for IRS/etc. Waste of space and poorly-duplicated functionality.

Microsoft does let you use other authenticators. My non-MS authenticator app has 3 MS accounts on it.

The funny thing is I have other MS accounts in my Google authenticator, but for one of my accounts specifically (maybe because it's the only one with Azure spend every month?) even though I have it in Google, I kept getting told on login I needed to set up MS Authenticator or SMS - no options for a different Auth app.

I'd attribute this to MS flakiness, or possibly AD policies. I've got work MS accounts, each connected to a multi-million dollar azure account, and each connected to a non-MS authenticator.

Reply on news.ycombinator.com