15 ms·

Microsoft's MFA is terrible. You install an app called Authenticator. Then when you login the Authenticator app gets a push notification, and the user has to sa

Microsoft's MFA is terrible. You install an app called Authenticator. Then when you login the Authenticator app gets a push notification, and the user has to say whether to allow the login or not. If you accidentally press Yes, the attacker gets in. And here's why this is a serious problem: When you use Remote Desktop to work, any time you have a network issue RDP automatically reconnects and you get an Authenticator notification. So during the work day you get frequent prompts that are automatically initiated by RDP reconnects. You get used to automatically saying Yes to the prompt. So when one of these prompts is initiated by an attacker's login there is no way to know, and you automatically answer Yes.

onaworkcomputer 5y ago
Don't you have to provide some information as part of the confirmation? Whenever something requests MFA, it will show a two digit number, and in the Authenticator app, I will be presented with three numbers and can only confirm the prompt if I select the same number that was shown by the requestor. My work MSFT account is even more locked down and requires me to type in the number.
- petilon 5y ago
  No, if you are on iPhone, Face Id authenticates, then you press a button to allow. That's it. There is no number to type anywhere.
  - onaworkcomputer 5y ago
    Oof. I wonder if admins can disable push notifications and just fall back to TOTP instead? Though it does sound like that would not be convenient if you have to enter a TOTP every time an RDP connection get interrupted.
  - scoopertrooper 5y ago
    ... you can still do the code based flow if you want...
  - mistrial9 5y ago
    I want to see what the execs use, not the code monkey "requirements"
  - EwanToo 5y ago
    For Office365 / AzureAD this is a configuration choice, admins can enable the numbers option which reduces the chances of accidental allows
  - larrybud 5y ago
    Sorry but the parent poster is correct. For both my corp account as well as my personal Microsoft account , I’m prompted to enter the validation number after I’ve faceid’d. If this doesn’t happen when you are authenticated, then it’s a setting with the system you’re logging into.
    - JoBrad 5y ago
      Same here. We disabled the push notification for Corp, but my personal account requires me to select a matching value.
  - judge2020 5y ago
    Administrators can enable it. If they have it set to 'Microsoft managed', number entry is enabled by default but not additional context. https://docs.microsoft.com/en-us/azure/active-directory/authentication/how-to-mfa-number-match https://docs.microsoft.com/en-us/azure/active-directory/auth...
- adolph 5y ago
  Depends on config. Bare minimum (mainstream?) is just a "blah blah service login" Accept|Deny. If you are in and out administering things and accessing protected documentation I could see how the login-to-mfa-popup latency and difference in tenancy names could give a window for a misclick.
- notesinthefield 5y ago
  Duo also works this way
INTPenis 5y ago
Also they want to lure you into using their own app by hiding the little link that allows you to get a normal OTP code. That bugs me more than anything, I don't want another app! I have over 30 codes in my open source OTP app, how would that even look if everyone wanted me to use their app?
mcintyre1994 5y ago
I quite like Google's approach, where you don't get a notification and have to go into the app to get the pop up. My bank does the same thing, you have to go into the app without a notification, see the pending transaction in your list and then approve/reject it. Feels a lot safer than push notifications for sure.
- koolba 5y ago
  Your bank lets you approve and reject individual transitions in real time or just ones that get flagged by them for fraud?
  - mcintyre1994 5y ago
    It’s their implementation of 3D Secure for online payments, which I think is based on a combination of heuristics and the merchant opting in/out. It’s a very good UX though, banks I’ve used in the past would ask you to enter some characters of your password on a weird looking 3D secure page. This is their blog when they announced it: https://monzo.com/blog/2018/08/22/launching-3d-secure https://monzo.com/blog/2018/08/22/launching-3d-secure
larrybud 5y ago
This is not always the case for Microsoft Authenticator. When I get a prompt on my iPhone, yes I need to use faceid, but I also need to enter a random number to “prove” a human has indeed accepted the auth request.
mattferderer 5y ago
Your dislike is probably more due to the configuration setup in your instance. As others pointed out, you can require matching a pin in the app with the one on the screen. With many of the MFA apps I have tied to Microsoft products, they typically store a session expiration where they don't have me re-authenticate with MFA until the next day. I've worked with many enterprises where the security group implements awful policies in an attempt to lock things down but instead create more risk by creating to much burden on employees which results in them finding clever hacks around the security. Just guessing, but probably not the tool here. Though they maybe could improve their defaults, docs or UI/UX.
- chockchocschoir 5y ago
  The problem with giving options regarding security is that sometimes the people who are responsible for setting up those, forget about "convenience versus security", or they get pressured by other groups to "forget" about that balance, and makes a lapse of judgement. We could, by laws and software, enforce a certain standard of security for organizations. The question is how liable you should be for that. Would have to consider many variables like size of company, importance of information and such.
- petilon 5y ago
  > more due to the configuration setup in your instance The obvious question here is, why does it have a configuration that allows an accidental or absent-minded employee to let in a hacker? Other authentication apps such as Symantec VIP does not use notifications, so the employee does not respond to a notification, instead he proactively starts the app to get a numeric code. Less convenient than saying Yes to a notification, but more secure.
  - annoyingnoob 5y ago
    I work with a few older employees. Its takes them longer to focus on the words on the screen and to read them (presbyopia happens). It takes longer to get into an app and read a code out. By the time they are ready the code is already changing in the app. It is much easier for them to touch an acknowledgement. We want security but we do not want to make security an impossible barrier for folks that need a little extra time (for whatever reason).
deleted 5y ago
[deleted]
tgsovlerkhgsel 5y ago
Also for other similar MFAs, if there is no rate limiting and the attacker spams the user, the user gets an unwanted notification and says no. The immediately gets the next unwanted notification and says no. The user doesn't want to deal with MFA, they want to use their phone, and the notifications are in the way. The user's primary goal is to make that stop. The logical thing to do is clicking "no", so the user does that. But that isn't working. Every time the user clicks no, a new notification pops up. Eventually the user learns: Clicking "no" does not work, it does not achieve his goal. If it hasn't worked 5 times, it probably won't work the next 100 times. So, the user tries something different. (And the best part it: It works!) The solution for this is obviously to provide a "no, and block requests until I open the app" button.
- throwra620 5y ago
- orlp 5y ago
  This is also why basically all GDPR consent trackers are "accidentally" so forgetful about your choice not to consent. You need to say no every single time (with potentially shifting interfaces). Similarly if I remember correctly WhatsApp would repeatedly ask you to accept the new terms of service with pop-ups until you one day accidentally mis-click on the consent button. I honestly don't understand how that would count for anything, legally speaking. But don't expect much help from the legal system here - think of how often we have said no to EARN IT, yet it keeps coming back. One slip though and you're stuck with it.
  - jbverschoor 5y ago
    Yeah I also accident accepted the WhatsApp terms after months of periodically denying, and I feel raped. Airtable did something similar recently with the grandfathered free accounts
    - jbverschoor 5y ago
      Thank you for downvoting me, airtable marketing crew lol
greggsy 5y ago
For most users, they’ll only get a prompt when they login to a new device, so the risk of notification fatigue is lessened, so I think it’s OK on that front. I agree however that admins are constantly bombarded with alerts and can suffer from vigilance fatigue. I think there is certainly a need for a different approach for more privileged users - it could be as simple as red banner, instead of the blue theme that is common across the MS, SalesForce and Okta MFA apps.
kevingadd 5y ago
Any time I need to get into my work account, the MS Authenticator app on my phone demands that I give it my thumbprint or enter a PIN.
AussieWog93 5y ago
Google did something even worse with old Google Drive links. I published a link to some documentation back in 2017, and set the permissions of the link to "view". Google, in their infinite wisdom, decided that somehow this link wasn't secure enough and now send notifications to my tablet every time someone clicks to manually authorise access. This would be a pain in the arse at best, but they've somehow managed to fuck things up even more. By default, the permissions I'm granting to the user through these notifications is set to "edit". Just to reiterate, they've "improved security" by spamming me with notifications to grant random members of the public full edit permissions on document that was intended from day one to be publicly accessible. I just weep sometimes.
- 2arrs2ells 5y ago
  This might be the individuals clicking to request edit access on the Doc: https://support.google.com/docs/answer/6239515?hl=en&co=GENIE.Platform%3DDesktop#zippy=%2Cif-you-can-view-only https://support.google.com/docs/answer/6239515?hl=en&co=GENI...
  - AussieWog93 5y ago
    It wasn't that. They sent me an email to tell me that I needed to regenerate the link for security purposes and after date x it would no longer function as normal.
    - yuliyp 5y ago
      That might be a "we need to change how we're generating URLs because we want to refactor stuff / not support the old format because it was too guessable or something" thing.
    - Plasmoid2000ad 5y ago
      I think that was for a simpler problem, that shared urls were not unique enough, and could be guessed or brute forced to get random peoples shared items. The articles published by google seemed to warn that there was an expectation gap on the amount of privacy people should have expected to have on them.
jeroenhd 5y ago
Luckily, MS also allows for FIDO2 and TOTP authenticators so you can make it a lot harder for criminals to get in. Especially with FIDO2 keys, you're pretty unlikely to get phished. As sibling comments indicate, there is an option to make the request for MFA more secure by providing a number to match your request, but it's pretty dumb that this security feature is disabled by default.
- vladvasiliu 5y ago
  > Luckily, MS also allows for FIDO2 This is not universal. It works on Windows with most browsers, but doesn't work on Firefox on Linux (works on Chrome on Linux) nor on Safari on Mac, nor Safari on iPhone, nor Teams on Linux (haven't tried Teams on Mac nor Windows).
- rdtwo 5y ago
  The number match still only give you 4 options so 25% chance of entry on Mis click
mlazos 5y ago
Not sure when you worked there, but I’ve seen that you have to enter a number that’s displayed on the device logging in, and the authenticator app shows the location of the device attempting to login as well.
EVa5I7bHFq9mnYK 5y ago
I haven't been able to understand what that lengthy article talks about, but with your short comment it is clear now. Why Authenticator needs push notifications, it's so stupid. I use Microsoft MFA with Authy without any problems and without any notifications.
_8j50 5y ago
It's not Microsot's MFA, others do this also. It's push notification authentication. Better than SMS in that sim swapping or ss7 type attacks won't work on it. They also support yubikey/fido, it's up to your AAD admin to allow any of those.
deleted 5y ago
[deleted]
filmgirlcw 5y ago
Except the push notification still requires you to authenticate with a biometric before it’ll open the app and fill your TOTP, ask your for a number to enter in, or approve the login. It’s not like you just tap it and you’re fine. You have tap and then log a biometric or PIN. You can turn the push notifications off or they are a concern, but I think it’s a bigger problem to allow stuff via biometric so passively. Personally, I like not having to switch to a Home Screen to open an auth app to approve or copy a code. Having it pop up for me and take me to where I can get stuff to auto fill or approve/enter in numbers is a really nice feature.
solarkraft 5y ago
When I had to use Windows for work (man, I'm glad I don't anymore) I used to get a ton of random password prompts (Sophos VPN, some Microsoft 365 or Windows accounts) with absolutely no way to tell whether they were legitimate or what triggered them. What a shit show. It's a weird thought that people use this crap in allegedly secure environments.

onaworkcomputer 5y ago

Don't you have to provide some information as part of the confirmation? Whenever something requests MFA, it will show a two digit number, and in the Authenticator app, I will be presented with three numbers and can only confirm the prompt if I select the same number that was shown by the requestor. My work MSFT account is even more locked down and requires me to type in the number.

petilon 5y ago
No, if you are on iPhone, Face Id authenticates, then you press a button to allow. That's it. There is no number to type anywhere.
- onaworkcomputer 5y ago
  Oof. I wonder if admins can disable push notifications and just fall back to TOTP instead? Though it does sound like that would not be convenient if you have to enter a TOTP every time an RDP connection get interrupted.
- scoopertrooper 5y ago
  ... you can still do the code based flow if you want...
- mistrial9 5y ago
  I want to see what the execs use, not the code monkey "requirements"
- EwanToo 5y ago
  For Office365 / AzureAD this is a configuration choice, admins can enable the numbers option which reduces the chances of accidental allows
- larrybud 5y ago
  Sorry but the parent poster is correct. For both my corp account as well as my personal Microsoft account , I’m prompted to enter the validation number after I’ve faceid’d. If this doesn’t happen when you are authenticated, then it’s a setting with the system you’re logging into.
  - JoBrad 5y ago
    Same here. We disabled the push notification for Corp, but my personal account requires me to select a matching value.
- judge2020 5y ago
  Administrators can enable it. If they have it set to 'Microsoft managed', number entry is enabled by default but not additional context. https://docs.microsoft.com/en-us/azure/active-directory/authentication/how-to-mfa-number-match https://docs.microsoft.com/en-us/azure/active-directory/auth...
adolph 5y ago
Depends on config. Bare minimum (mainstream?) is just a "blah blah service login" Accept|Deny. If you are in and out administering things and accessing protected documentation I could see how the login-to-mfa-popup latency and difference in tenancy names could give a window for a misclick.
notesinthefield 5y ago
Duo also works this way

INTPenis 5y ago

Also they want to lure you into using their own app by hiding the little link that allows you to get a normal OTP code. That bugs me more than anything, I don't want another app! I have over 30 codes in my open source OTP app, how would that even look if everyone wanted me to use their app?

mcintyre1994 5y ago

I quite like Google's approach, where you don't get a notification and have to go into the app to get the pop up. My bank does the same thing, you have to go into the app without a notification, see the pending transaction in your list and then approve/reject it. Feels a lot safer than push notifications for sure.

koolba 5y ago
Your bank lets you approve and reject individual transitions in real time or just ones that get flagged by them for fraud?
- mcintyre1994 5y ago
  It’s their implementation of 3D Secure for online payments, which I think is based on a combination of heuristics and the merchant opting in/out. It’s a very good UX though, banks I’ve used in the past would ask you to enter some characters of your password on a weird looking 3D secure page. This is their blog when they announced it: https://monzo.com/blog/2018/08/22/launching-3d-secure https://monzo.com/blog/2018/08/22/launching-3d-secure

larrybud 5y ago

This is not always the case for Microsoft Authenticator. When I get a prompt on my iPhone, yes I need to use faceid, but I also need to enter a random number to “prove” a human has indeed accepted the auth request.

mattferderer 5y ago

Your dislike is probably more due to the configuration setup in your instance. As others pointed out, you can require matching a pin in the app with the one on the screen. With many of the MFA apps I have tied to Microsoft products, they typically store a session expiration where they don't have me re-authenticate with MFA until the next day. I've worked with many enterprises where the security group implements awful policies in an attempt to lock things down but instead create more risk by creating to much burden on employees which results in them finding clever hacks around the security. Just guessing, but probably not the tool here. Though they maybe could improve their defaults, docs or UI/UX.

chockchocschoir 5y ago
The problem with giving options regarding security is that sometimes the people who are responsible for setting up those, forget about "convenience versus security", or they get pressured by other groups to "forget" about that balance, and makes a lapse of judgement. We could, by laws and software, enforce a certain standard of security for organizations. The question is how liable you should be for that. Would have to consider many variables like size of company, importance of information and such.
petilon 5y ago
> more due to the configuration setup in your instance The obvious question here is, why does it have a configuration that allows an accidental or absent-minded employee to let in a hacker? Other authentication apps such as Symantec VIP does not use notifications, so the employee does not respond to a notification, instead he proactively starts the app to get a numeric code. Less convenient than saying Yes to a notification, but more secure.
- annoyingnoob 5y ago
  I work with a few older employees. Its takes them longer to focus on the words on the screen and to read them (presbyopia happens). It takes longer to get into an app and read a code out. By the time they are ready the code is already changing in the app. It is much easier for them to touch an acknowledgement. We want security but we do not want to make security an impossible barrier for folks that need a little extra time (for whatever reason).

deleted 5y ago

[deleted]

tgsovlerkhgsel 5y ago

Also for other similar MFAs, if there is no rate limiting and the attacker spams the user, the user gets an unwanted notification and says no. The immediately gets the next unwanted notification and says no. The user doesn't want to deal with MFA, they want to use their phone, and the notifications are in the way. The user's primary goal is to make that stop. The logical thing to do is clicking "no", so the user does that. But that isn't working. Every time the user clicks no, a new notification pops up. Eventually the user learns: Clicking "no" does not work, it does not achieve his goal. If it hasn't worked 5 times, it probably won't work the next 100 times. So, the user tries something different. (And the best part it: It works!) The solution for this is obviously to provide a "no, and block requests until I open the app" button.

throwra620 5y ago
orlp 5y ago
This is also why basically all GDPR consent trackers are "accidentally" so forgetful about your choice not to consent. You need to say no every single time (with potentially shifting interfaces). Similarly if I remember correctly WhatsApp would repeatedly ask you to accept the new terms of service with pop-ups until you one day accidentally mis-click on the consent button. I honestly don't understand how that would count for anything, legally speaking. But don't expect much help from the legal system here - think of how often we have said no to EARN IT, yet it keeps coming back. One slip though and you're stuck with it.
- jbverschoor 5y ago
  Yeah I also accident accepted the WhatsApp terms after months of periodically denying, and I feel raped. Airtable did something similar recently with the grandfathered free accounts
  - jbverschoor 5y ago
    Thank you for downvoting me, airtable marketing crew lol

greggsy 5y ago

For most users, they’ll only get a prompt when they login to a new device, so the risk of notification fatigue is lessened, so I think it’s OK on that front. I agree however that admins are constantly bombarded with alerts and can suffer from vigilance fatigue. I think there is certainly a need for a different approach for more privileged users - it could be as simple as red banner, instead of the blue theme that is common across the MS, SalesForce and Okta MFA apps.

kevingadd 5y ago

Any time I need to get into my work account, the MS Authenticator app on my phone demands that I give it my thumbprint or enter a PIN.

AussieWog93 5y ago

Google did something even worse with old Google Drive links. I published a link to some documentation back in 2017, and set the permissions of the link to "view". Google, in their infinite wisdom, decided that somehow this link wasn't secure enough and now send notifications to my tablet every time someone clicks to manually authorise access. This would be a pain in the arse at best, but they've somehow managed to fuck things up even more. By default, the permissions I'm granting to the user through these notifications is set to "edit". Just to reiterate, they've "improved security" by spamming me with notifications to grant random members of the public full edit permissions on document that was intended from day one to be publicly accessible. I just weep sometimes.

2arrs2ells 5y ago
This might be the individuals clicking to request edit access on the Doc: https://support.google.com/docs/answer/6239515?hl=en&co=GENIE.Platform%3DDesktop#zippy=%2Cif-you-can-view-only https://support.google.com/docs/answer/6239515?hl=en&co=GENI...
- AussieWog93 5y ago
  It wasn't that. They sent me an email to tell me that I needed to regenerate the link for security purposes and after date x it would no longer function as normal.
  - yuliyp 5y ago
    That might be a "we need to change how we're generating URLs because we want to refactor stuff / not support the old format because it was too guessable or something" thing.
  - Plasmoid2000ad 5y ago
    I think that was for a simpler problem, that shared urls were not unique enough, and could be guessed or brute forced to get random peoples shared items. The articles published by google seemed to warn that there was an expectation gap on the amount of privacy people should have expected to have on them.

jeroenhd 5y ago

Luckily, MS also allows for FIDO2 and TOTP authenticators so you can make it a lot harder for criminals to get in. Especially with FIDO2 keys, you're pretty unlikely to get phished. As sibling comments indicate, there is an option to make the request for MFA more secure by providing a number to match your request, but it's pretty dumb that this security feature is disabled by default.

vladvasiliu 5y ago
> Luckily, MS also allows for FIDO2 This is not universal. It works on Windows with most browsers, but doesn't work on Firefox on Linux (works on Chrome on Linux) nor on Safari on Mac, nor Safari on iPhone, nor Teams on Linux (haven't tried Teams on Mac nor Windows).
rdtwo 5y ago
The number match still only give you 4 options so 25% chance of entry on Mis click

mlazos 5y ago

Not sure when you worked there, but I’ve seen that you have to enter a number that’s displayed on the device logging in, and the authenticator app shows the location of the device attempting to login as well.

EVa5I7bHFq9mnYK 5y ago

I haven't been able to understand what that lengthy article talks about, but with your short comment it is clear now. Why Authenticator needs push notifications, it's so stupid. I use Microsoft MFA with Authy without any problems and without any notifications.

_8j50 5y ago

It's not Microsot's MFA, others do this also. It's push notification authentication. Better than SMS in that sim swapping or ss7 type attacks won't work on it. They also support yubikey/fido, it's up to your AAD admin to allow any of those.

deleted 5y ago

[deleted]

filmgirlcw 5y ago

Except the push notification still requires you to authenticate with a biometric before it’ll open the app and fill your TOTP, ask your for a number to enter in, or approve the login. It’s not like you just tap it and you’re fine. You have tap and then log a biometric or PIN. You can turn the push notifications off or they are a concern, but I think it’s a bigger problem to allow stuff via biometric so passively. Personally, I like not having to switch to a Home Screen to open an auth app to approve or copy a code. Having it pop up for me and take me to where I can get stuff to auto fill or approve/enter in numbers is a really nice feature.

solarkraft 5y ago

When I had to use Windows for work (man, I'm glad I don't anymore) I used to get a ton of random password prompts (Sophos VPN, some Microsoft 365 or Windows accounts) with absolutely no way to tell whether they were legitimate or what triggered them. What a shit show. It's a weird thought that people use this crap in allegedly secure environments.