4 ms·

Also for other similar MFAs, if there is no rate limiting and the attacker spams the user, the user gets an unwanted notification and says no. The immediately g

Also for other similar MFAs, if there is no rate limiting and the attacker spams the user, the user gets an unwanted notification and says no. The immediately gets the next unwanted notification and says no. The user doesn't want to deal with MFA, they want to use their phone, and the notifications are in the way. The user's primary goal is to make that stop. The logical thing to do is clicking "no", so the user does that. But that isn't working. Every time the user clicks no, a new notification pops up. Eventually the user learns: Clicking "no" does not work, it does not achieve his goal. If it hasn't worked 5 times, it probably won't work the next 100 times. So, the user tries something different. (And the best part it: It works!) The solution for this is obviously to provide a "no, and block requests until I open the app" button.

throwra620 5y ago
orlp 5y ago
This is also why basically all GDPR consent trackers are "accidentally" so forgetful about your choice not to consent. You need to say no every single time (with potentially shifting interfaces). Similarly if I remember correctly WhatsApp would repeatedly ask you to accept the new terms of service with pop-ups until you one day accidentally mis-click on the consent button. I honestly don't understand how that would count for anything, legally speaking. But don't expect much help from the legal system here - think of how often we have said no to EARN IT, yet it keeps coming back. One slip though and you're stuck with it.
- jbverschoor 5y ago
  Yeah I also accident accepted the WhatsApp terms after months of periodically denying, and I feel raped. Airtable did something similar recently with the grandfathered free accounts
  - jbverschoor 5y ago
    Thank you for downvoting me, airtable marketing crew lol
- pilsetnieks 5y ago
  Just like the IRA said to Thatcher: "Today we were unlucky, but remember we only have to be lucky once. You will have to be lucky always."
- vba616 5y ago
  >This is also why basically all GDPR consent trackers are "accidentally" so forgetful about your choice not to consent They're perfectly entitled to track you as long as you don't opt out. And when you opt out, they can't be held responsible for remembering it for even an instant, because they can't identify you. "That's some catch, that Catch-22"
  - brendoelfrendo 5y ago
    Yeah, one website I visited recently helpfully showed me the cookies that it would save if I accepted their cookie agreement. The first one on the list was the cookie to remember my response to their cookie agreement.
  - distances 5y ago
    This also makes the cookie prompts a pain for users who don't use cookies. My browser rejects all cookies by default, so I end up creating uBlock filter rules for the prompts on sites I frequently visit.
  - orlp 5y ago
    > They're perfectly entitled to track you as long as you don't opt out. This is false, GDPR is opt-in.
    - vba616 5y ago
      Irrelephant. Since you didn't opt in, you haven't allowed them to track you, and they can't remember that you didn't opt in without tracking you. See?
  - solarkraft 5y ago
    > They're perfectly entitled to track you as long as you don't opt out. Um ... huh? GDPR requires explicit consent.
- ornornor 5y ago
  Whatsapp also helpfully nags you constantly to enable notifications if they’re disabled and to enable (unencrypted) backups to the cloud.
- lupire 5y ago
  This is illegal under GDPR, but enforcement is currently overwhelmed with violators.
underdeserver 5y ago
The solution is obviously to not show a notification at all, ever. If I'm trying to log in, I know that I have to go into Authenticator and approve, so just check if there are outstanding requests (e.g. with a 2 minute timeout) when I open the app.
- XorNot 5y ago
  Except that's still a failure: the attack can script that to ensure there's always a notification. Doesn't have to get it right then and there either - they have infinite time. Might be this month, might be next month. The user interaction of classic TOTP forms an important grounding function: it forces (in most cases) spatial locality of the user and the device being interacted with.
  - bayindirh 5y ago
    Some providers also give a unique identifier to each request. I always check them if it's present. Also, having multiple selections (numbers) also prevents this attack somehow. Your prompt says 7/56/9, but neither is there. So what? Or, you have the number in your prompt by chance, and it's not the right choice for that prompt. Nevertheless, at the end of the day the buck always stops at the user. User have to be diligent and shall have no blind trust on anyone/anything.
    - lupire 5y ago
      If a hacker uses my account to hack my employer via Microsoft's terrible MFA, it's not my problem. The buck stops, as always, with the person who cares about the resource being accessed, or who is made to care by being legally liable. For a disgruntled employee (most employees), getting hacked is a win-win.
      - bayindirh 5y ago
        That's an interesting take. Let's change names. What if it's Google, Blizzard / Epic (Battle.net), and something personal? These services use the same flows. Or worse, what if it's your e-Government app, and you lose all your identifying information and somebody can become "you" with all the information they got? Will you say "Meh, it's a personal account, and I gave access via MFA, but who cares, it's not my problem?".

throwra620 5y ago

orlp 5y ago

This is also why basically all GDPR consent trackers are "accidentally" so forgetful about your choice not to consent. You need to say no every single time (with potentially shifting interfaces). Similarly if I remember correctly WhatsApp would repeatedly ask you to accept the new terms of service with pop-ups until you one day accidentally mis-click on the consent button. I honestly don't understand how that would count for anything, legally speaking. But don't expect much help from the legal system here - think of how often we have said no to EARN IT, yet it keeps coming back. One slip though and you're stuck with it.

jbverschoor 5y ago
Yeah I also accident accepted the WhatsApp terms after months of periodically denying, and I feel raped. Airtable did something similar recently with the grandfathered free accounts
- jbverschoor 5y ago
  Thank you for downvoting me, airtable marketing crew lol
pilsetnieks 5y ago
Just like the IRA said to Thatcher: "Today we were unlucky, but remember we only have to be lucky once. You will have to be lucky always."
vba616 5y ago
>This is also why basically all GDPR consent trackers are "accidentally" so forgetful about your choice not to consent They're perfectly entitled to track you as long as you don't opt out. And when you opt out, they can't be held responsible for remembering it for even an instant, because they can't identify you. "That's some catch, that Catch-22"
- brendoelfrendo 5y ago
  Yeah, one website I visited recently helpfully showed me the cookies that it would save if I accepted their cookie agreement. The first one on the list was the cookie to remember my response to their cookie agreement.
- distances 5y ago
  This also makes the cookie prompts a pain for users who don't use cookies. My browser rejects all cookies by default, so I end up creating uBlock filter rules for the prompts on sites I frequently visit.
- orlp 5y ago
  > They're perfectly entitled to track you as long as you don't opt out. This is false, GDPR is opt-in.
  - vba616 5y ago
    Irrelephant. Since you didn't opt in, you haven't allowed them to track you, and they can't remember that you didn't opt in without tracking you. See?
- solarkraft 5y ago
  > They're perfectly entitled to track you as long as you don't opt out. Um ... huh? GDPR requires explicit consent.
ornornor 5y ago
Whatsapp also helpfully nags you constantly to enable notifications if they’re disabled and to enable (unencrypted) backups to the cloud.
lupire 5y ago
This is illegal under GDPR, but enforcement is currently overwhelmed with violators.

underdeserver 5y ago

The solution is obviously to not show a notification at all, ever. If I'm trying to log in, I know that I have to go into Authenticator and approve, so just check if there are outstanding requests (e.g. with a 2 minute timeout) when I open the app.

XorNot 5y ago
Except that's still a failure: the attack can script that to ensure there's always a notification. Doesn't have to get it right then and there either - they have infinite time. Might be this month, might be next month. The user interaction of classic TOTP forms an important grounding function: it forces (in most cases) spatial locality of the user and the device being interacted with.
- bayindirh 5y ago
  Some providers also give a unique identifier to each request. I always check them if it's present. Also, having multiple selections (numbers) also prevents this attack somehow. Your prompt says 7/56/9, but neither is there. So what? Or, you have the number in your prompt by chance, and it's not the right choice for that prompt. Nevertheless, at the end of the day the buck always stops at the user. User have to be diligent and shall have no blind trust on anyone/anything.
  - lupire 5y ago
    If a hacker uses my account to hack my employer via Microsoft's terrible MFA, it's not my problem. The buck stops, as always, with the person who cares about the resource being accessed, or who is made to care by being legally liable. For a disgruntled employee (most employees), getting hacked is a win-win.
    - bayindirh 5y ago
      That's an interesting take. Let's change names. What if it's Google, Blizzard / Epic (Battle.net), and something personal? These services use the same flows. Or worse, what if it's your e-Government app, and you lose all your identifying information and somebody can become "you" with all the information they got? Will you say "Meh, it's a personal account, and I gave access via MFA, but who cares, it's not my problem?".