4 ms·

> I have already had several malicious login attempts Doesn't that mean they know your username and password? How does that happen so easily.

brenns10 3y ago
They said login attempt, not successful login. So no.
- throwawaysleep 3y ago
  But to get to the auth request, do you not need to pass the password stage first? I get these pretty frequently on my work machines as I reuse my passwords and they have already leaked. At least that was my assumption.
  - amanzi 3y ago
    I assume this is referring to the passwordless logon feature, which most enterprises disable. But with this feature, you just need to enter the username (email address) and choose the option to log in with authenticator.
- vladvasiliu 3y ago
  Since they talked about the authenticator app, it depends on how it's set up. You can enable it for passwordless logins, so you'd get the prompt for knowing the account name.
hunter2_ 3y ago
The line you quoted doesn't mean they know the password. But this one does: > Fortunately I'm attuned enough to decline them. There is only something to decline if they know your password.
- amanzi 3y ago
  I assume this is referring to the passwordless logon feature, which most enterprises disable. But with this feature, you just need to enter the username (email address) and choose the option to log in with authenticator. Regarding MFA-fatigue, this is mitigated by asking the user to enter the same number into Authenticator that is displayed on the login screen. So that takes away the chance of accidentally approving an MFA prompt.
shortcake27 3y ago
The last time I used Microsoft Authenticator (which was quite a few years ago), I noticed it would send me a request regardless of whether the correct password was entered or not. I suppose this is one of those "security by obscurity" type measures where they don't want to reveal whether the password was correct or not before MFAing. However, this results in non-stop requests because every few hours someone somewhere in the world attempts to penetrate my MS account. This became so tiresome that I disabled MFA. Here's a hot take: if your MFA solution fatigues people to the point they disable MFA, you have a problem. Also, I'm wondering if the OP might be referring to passwordless "Approve this login request" notifications rather than plain old MFA, where someone just needs to enter your email address and hope you approve the login request. Not sure if MS does this, but I know other apps that do.
- afiori 3y ago
  MS still has not solved the notification fatigue but now the SSO gives you a 2 digit number you need to insert in the app. This solves the problem of accepting the wrong login by mistake

brenns10 3y ago

They said login attempt, not successful login. So no.

throwawaysleep 3y ago
But to get to the auth request, do you not need to pass the password stage first? I get these pretty frequently on my work machines as I reuse my passwords and they have already leaked. At least that was my assumption.
- amanzi 3y ago
  I assume this is referring to the passwordless logon feature, which most enterprises disable. But with this feature, you just need to enter the username (email address) and choose the option to log in with authenticator.
vladvasiliu 3y ago
Since they talked about the authenticator app, it depends on how it's set up. You can enable it for passwordless logins, so you'd get the prompt for knowing the account name.

hunter2_ 3y ago

The line you quoted doesn't mean they know the password. But this one does: > Fortunately I'm attuned enough to decline them. There is only something to decline if they know your password.

amanzi 3y ago
I assume this is referring to the passwordless logon feature, which most enterprises disable. But with this feature, you just need to enter the username (email address) and choose the option to log in with authenticator. Regarding MFA-fatigue, this is mitigated by asking the user to enter the same number into Authenticator that is displayed on the login screen. So that takes away the chance of accidentally approving an MFA prompt.

shortcake27 3y ago

The last time I used Microsoft Authenticator (which was quite a few years ago), I noticed it would send me a request regardless of whether the correct password was entered or not. I suppose this is one of those "security by obscurity" type measures where they don't want to reveal whether the password was correct or not before MFAing. However, this results in non-stop requests because every few hours someone somewhere in the world attempts to penetrate my MS account. This became so tiresome that I disabled MFA. Here's a hot take: if your MFA solution fatigues people to the point they disable MFA, you have a problem. Also, I'm wondering if the OP might be referring to passwordless "Approve this login request" notifications rather than plain old MFA, where someone just needs to enter your email address and hope you approve the login request. Not sure if MS does this, but I know other apps that do.

afiori 3y ago
MS still has not solved the notification fatigue but now the SSO gives you a 2 digit number you need to insert in the app. This solves the problem of accepting the wrong login by mistake