5 ms·

This is why you have to give the enduser a way of authenticating the authenticator. The well-designed Adobe Account Access app often presents the user with a ra

by ttul 5y ago

This is why you have to give the enduser a way of authenticating the authenticator. The well-designed Adobe Account Access app often presents the user with a random number that they have to tap on in the authenticator app. The authenticator app presents that number along with some other random numbers, asking the user to pick the correct one. The random number list is not always presented. I presume that Adobe skips presenting the number challenge if the user is logging in with a relatively fresh cookie or from a recently associated device. But I guarantee that login attempts from a new device would prompt this more strict authentication step. Microsoft now appears to do this (thank you, Traubenfuchs).

Traubenfuchs 5y ago
Microsoft Authenticator does that. Outlook.com logins need you to press the right number in Microsoft Authenticator.
- Kliment 5y ago
  That's actually shown in the article as a mitigation strategy
- jiggawatts 5y ago
  But enterprise users don’t! The more important the system, the worse Microsoft’s MFA security is. Their strongest protection is for XBox accounts. Because they know that their users value their personal Minecraft skins more than billions of dollars worth of their employer’s stuff.
  - thereddaikon 5y ago
    That's not it at all. Its difficult to get buy in on stricter security practices in an organization because people dont like to be hassled. Enterprise security is always a balancing act with user inconvenience. Microsoft can get away with it in Xbox because they can set the terms for how an individual gets to access the service. An individual consumer doesn't have much of a choice but trying to force the same terms on business users could cause them to not use it at all or jump vendors.
  - judge2020 5y ago
    Enterprises have very fine-grained ways to manage the 2fa flow. My AAD-based account requires I type in the full number on the Authenticator app; not choose from 3 numbers. https://docs.microsoft.com/en-us/azure/active-directory/authentication/how-to-mfa-number-match https://docs.microsoft.com/en-us/azure/active-directory/auth... https://docs.microsoft.com/en-us/azure/active-directory/authentication/how-to-mfa-additional-context https://docs.microsoft.com/en-us/azure/active-directory/auth...
    - jiggawatts 5y ago
      Use number matching -- Preview Use additional context -- Preview Awesome. Let me just convince my enterprise customer where I'm not even an employee to mass enable two PREVIEW features for 35K users. That'll go down well. Users cannot opt in to more secure authentication options individually. The default is woefully insecure, almost pointless security theatre. The secure option is unsupported in production. Hardware token-based security is disabled by default, and carefully hidden behind dark patterns to boost the numbers of the MS Authenticator app so that some manager at Microsoft can meet his personal KPIs and get his bonus. Customers using features like Azure AD multi-tenant applications cannot enforce MFA themselves -- Microsoft reserves this capability for their own applications only. Even if I enforce hardware token MFA in my own personal Azure AD tenant, if I get invited to some other tenant as a Guest (e.g.: to a Teams meeting), then I'm forced to sign in using their MFA policy, which is more than likely the default MS Authenticator app with all optional features like this disabled. To say that Enterprise customers have lots of options is patently false. Microsoft only cares about security when it affects their own systems.
      - tialaramex 5y ago
        > Microsoft only cares about security when it affects their own systems. I don't think even that's true. Unlike at Google and to some extent Apple, I don't sense that Microsoft's internal corporate culture wants security per se. Both Google and Apple seem comfortable with the idea that if you can solve a security problem for $15 you have one option, "Secure" and it costs $15 and the only question is whether "Not secure" should be available for $0 (OK at Apple maybe "Secure" inexplicably costs $30 because it's a premium product but equally maybe "Secure" was "free" with your $1000 premium Apple product, for this argument either outcome is fine). Microsoft seems excited about offering "Somewhat secure" for $5 and "A bit more secure" for $10 and if just "Secure" is an option at all, it needs to be priced at $100 to show what a bargain the "Somewhat secure" option is. This is a reasonable mindset if you make padlocks or something, but a crummy attitude for digital security where we can so often just solve the problem full stop. Remember how Intel couldn't persuade people the Pentium FDIV bug wasn't a big deal? Nobody wants a computer that sometimes gets arithmetic wrong "a little bit" they want the correct answers and anything less is unacceptable.
  - duskwuff 5y ago
    > Because they know that their users value their personal Minecraft skins more than billions of dollars worth of their employer’s stuff. Or because the XBox team isn't beholden to corporate clients, so they're much more free to make changes which affect user workflows.
  - slaymaker1907 5y ago
    You can definitely use this in some enterprise contexts. This is what I usually do for logging into Azure.
stavros 5y ago
Google does that as well.
deleted 5y ago
[deleted]
dfxm12 5y ago
My bank used to show me a picture that I specified, after I put in my username, but before I put in my password. I knew that if I was being shown an odd picture, I either typed in my username incorrectly, or I was not logging into my bank! I think would make scams more obvious, even in the face of MFA fatigue!
- joshuaissac 5y ago
  Yahoo used to do this, called Yahoo! Sign-In Seal. Not sure if they still do it.
- Nextgrid 5y ago
  Surely an attacker can just proxy this? Seems like security theatre to me.
  - motoboi 5y ago
    This is for phishing attacks with lookalike domains and sites. Pretty common in the web banking world.
    - Nextgrid 5y ago
      Yes but I'm pretty sure the lookalike domain proxy your username and the "security picture" back to the real domain to make it look legitimate.
      - tialaramex 5y ago
        The software to do it is even available on GitHub IIRC. Purely for research purposes of course. We know how to actually fix this, apparently people don't want to :(
  - jakub_g 5y ago
    Yep. This is kinda useful as an indicator whether you wrote login correctly (wrong pic = wrong login) and to weed out the lowest quality phishing, but for anyone who's not a clown it should be easy to recreate the flow and hence, it's actually even harmful (you think you get assurance you're not scammed while getting scammed). Edit: one thing to make it more bulletproof would be bank rejecting all calls that look like serverish initiated (AWS etc), then the attacker would need some genuinely looking botnet to not get blocked by the bank due to suspicious volume from same IP pool. Raises the bar for attack, but still, serious attacker can mitigate this.

by ttul 5y ago

Traubenfuchs 5y ago

Microsoft Authenticator does that. Outlook.com logins need you to press the right number in Microsoft Authenticator.

Kliment 5y ago
That's actually shown in the article as a mitigation strategy
jiggawatts 5y ago
But enterprise users don’t! The more important the system, the worse Microsoft’s MFA security is. Their strongest protection is for XBox accounts. Because they know that their users value their personal Minecraft skins more than billions of dollars worth of their employer’s stuff.
- thereddaikon 5y ago
  That's not it at all. Its difficult to get buy in on stricter security practices in an organization because people dont like to be hassled. Enterprise security is always a balancing act with user inconvenience. Microsoft can get away with it in Xbox because they can set the terms for how an individual gets to access the service. An individual consumer doesn't have much of a choice but trying to force the same terms on business users could cause them to not use it at all or jump vendors.
- judge2020 5y ago
  Enterprises have very fine-grained ways to manage the 2fa flow. My AAD-based account requires I type in the full number on the Authenticator app; not choose from 3 numbers. https://docs.microsoft.com/en-us/azure/active-directory/authentication/how-to-mfa-number-match https://docs.microsoft.com/en-us/azure/active-directory/auth... https://docs.microsoft.com/en-us/azure/active-directory/authentication/how-to-mfa-additional-context https://docs.microsoft.com/en-us/azure/active-directory/auth...
  - jiggawatts 5y ago
    Use number matching -- Preview Use additional context -- Preview Awesome. Let me just convince my enterprise customer where I'm not even an employee to mass enable two PREVIEW features for 35K users. That'll go down well. Users cannot opt in to more secure authentication options individually. The default is woefully insecure, almost pointless security theatre. The secure option is unsupported in production. Hardware token-based security is disabled by default, and carefully hidden behind dark patterns to boost the numbers of the MS Authenticator app so that some manager at Microsoft can meet his personal KPIs and get his bonus. Customers using features like Azure AD multi-tenant applications cannot enforce MFA themselves -- Microsoft reserves this capability for their own applications only. Even if I enforce hardware token MFA in my own personal Azure AD tenant, if I get invited to some other tenant as a Guest (e.g.: to a Teams meeting), then I'm forced to sign in using their MFA policy, which is more than likely the default MS Authenticator app with all optional features like this disabled. To say that Enterprise customers have lots of options is patently false. Microsoft only cares about security when it affects their own systems.
    - tialaramex 5y ago
      > Microsoft only cares about security when it affects their own systems. I don't think even that's true. Unlike at Google and to some extent Apple, I don't sense that Microsoft's internal corporate culture wants security per se. Both Google and Apple seem comfortable with the idea that if you can solve a security problem for $15 you have one option, "Secure" and it costs $15 and the only question is whether "Not secure" should be available for $0 (OK at Apple maybe "Secure" inexplicably costs $30 because it's a premium product but equally maybe "Secure" was "free" with your $1000 premium Apple product, for this argument either outcome is fine). Microsoft seems excited about offering "Somewhat secure" for $5 and "A bit more secure" for $10 and if just "Secure" is an option at all, it needs to be priced at $100 to show what a bargain the "Somewhat secure" option is. This is a reasonable mindset if you make padlocks or something, but a crummy attitude for digital security where we can so often just solve the problem full stop. Remember how Intel couldn't persuade people the Pentium FDIV bug wasn't a big deal? Nobody wants a computer that sometimes gets arithmetic wrong "a little bit" they want the correct answers and anything less is unacceptable.
- duskwuff 5y ago
  > Because they know that their users value their personal Minecraft skins more than billions of dollars worth of their employer’s stuff. Or because the XBox team isn't beholden to corporate clients, so they're much more free to make changes which affect user workflows.
- slaymaker1907 5y ago
  You can definitely use this in some enterprise contexts. This is what I usually do for logging into Azure.

stavros 5y ago

Google does that as well.

deleted 5y ago

[deleted]

dfxm12 5y ago

My bank used to show me a picture that I specified, after I put in my username, but before I put in my password. I knew that if I was being shown an odd picture, I either typed in my username incorrectly, or I was not logging into my bank! I think would make scams more obvious, even in the face of MFA fatigue!

joshuaissac 5y ago
Yahoo used to do this, called Yahoo! Sign-In Seal. Not sure if they still do it.
Nextgrid 5y ago
Surely an attacker can just proxy this? Seems like security theatre to me.
- motoboi 5y ago
  This is for phishing attacks with lookalike domains and sites. Pretty common in the web banking world.
  - Nextgrid 5y ago
    Yes but I'm pretty sure the lookalike domain proxy your username and the "security picture" back to the real domain to make it look legitimate.
    - tialaramex 5y ago
      The software to do it is even available on GitHub IIRC. Purely for research purposes of course. We know how to actually fix this, apparently people don't want to :(
- jakub_g 5y ago
  Yep. This is kinda useful as an indicator whether you wrote login correctly (wrong pic = wrong login) and to weed out the lowest quality phishing, but for anyone who's not a clown it should be easy to recreate the flow and hence, it's actually even harmful (you think you get assurance you're not scammed while getting scammed). Edit: one thing to make it more bulletproof would be bank rejecting all calls that look like serverish initiated (AWS etc), then the attacker would need some genuinely looking botnet to not get blocked by the bank due to suspicious volume from same IP pool. Raises the bar for attack, but still, serious attacker can mitigate this.