5 ms·

Funny I keep getting login codes for my Microsoft account. Also there is seemingly no way to figure out who is doing it or how to stop it. I wish I could just

Funny I keep getting login codes for my Microsoft account. Also there is seemingly no way to figure out who is doing it or how to stop it. I wish I could just disable that form of login, I have a very safe password so the login via email isn't necessary.

owlboy 3y ago
I’ve seen that and the FB one in recent months.
joezydeco 3y ago
Same here. At first it was just my account but now family members are getting it too. Microsoft doesn't show you login attempt IP addresses like Google does?
- johngladtj 3y ago
  It does, but only when they use the password login...
flangola7 3y ago
Your org's admin can see it in the Azure portal.
tuhriel 3y ago
It's like the google 2FA where you can accept the login on ANY android device where you are logged in. and you can't disable the feature and the only way to remove the option from a device is to logout your account on the device... I have an tabled and an phone which is used by other people in my family and I definitely don't want the 2FA requests on these devices...
laurencei 3y ago
Yeah - and what is crazy is when you think about it - Microsoft generates a 6 digit code. So it is a "one in a million" to randomly guess what the code is on any given login. But it is "one in a million" for each Microsoft account you know about - and if they have millions of email addresses, and automate it each day (I also get attempts 1-2 times per day). Yes - the odds are small - but there is a greater than 0% chance someone can randomly get into your Microsoft account - and there is no way to stop it - even with 2FA etc - this bypasses all of that!!! Crazy...
- joezydeco 3y ago
  I'm a little confused. Does the code get generated on any attempt to log in, or only those that have the password and MFA is activated? Or when someone attempts password recovery? Because I'm a bit concerned if Microsoft passwords are leaking.
  - laurencei 3y ago
    When attempting to login to your Microsoft account, instead of typing your password you can do an optional "one time password" generation thing from Microsoft. So instead of typing your password +2FA - they email you a 6 digit "one time password" that you can use instead. You cant disable this. So all Microsoft accounts could have a daily 1 in 1 million chance of been overtaken. Odds are low - but if you then spam this across thousands of attempts per day - they would statisically "get lucky" from time to time...
    - joezydeco 3y ago
      That makes much more sense, thanks. I'm guilty of using this from time to time as well.
    - firebat45 3y ago
      One would think Microsoft wouldn't be stupid enough to provide endless amounts of one time codes for a single account. I would guess they provide 5-10 codes before escalating the login.
- nitwit005 3y ago
  If you have 500 million accounts you know of, you'd be breaking into around 500-1000 a day. I suppose that's a decent rate, but it feels like most Microsoft accounts will just have something like Office or Minecraft set up.
SeasonalEnnui 3y ago
Have you got an exchange email or Teams set up on a mobile device? These will generate 2FA requests (but not make any kind of notification on the device).
alaxapta7 3y ago
I thought this was the Passwordless account they implemented (EDIT: didn't realize you weren't talking about the Authenticator app), but I had it turned off. I somehow managed to make it stop by re-enabling/re-disabling both Passwordless and 2FA. So now they always ask me for a password and then I get the challenge. To this day, I can't comprehend how this is supposed to be safe. So someone can just type in my username and wait until i eventually misclick in the Authenticator app? If it was from a browser I have used before at least, but I was getting these challenges from around the globe.

owlboy 3y ago

I’ve seen that and the FB one in recent months.

joezydeco 3y ago

Same here. At first it was just my account but now family members are getting it too. Microsoft doesn't show you login attempt IP addresses like Google does?

johngladtj 3y ago
It does, but only when they use the password login...

flangola7 3y ago

Your org's admin can see it in the Azure portal.

tuhriel 3y ago

It's like the google 2FA where you can accept the login on ANY android device where you are logged in. and you can't disable the feature and the only way to remove the option from a device is to logout your account on the device... I have an tabled and an phone which is used by other people in my family and I definitely don't want the 2FA requests on these devices...

laurencei 3y ago

Yeah - and what is crazy is when you think about it - Microsoft generates a 6 digit code. So it is a "one in a million" to randomly guess what the code is on any given login. But it is "one in a million" for each Microsoft account you know about - and if they have millions of email addresses, and automate it each day (I also get attempts 1-2 times per day). Yes - the odds are small - but there is a greater than 0% chance someone can randomly get into your Microsoft account - and there is no way to stop it - even with 2FA etc - this bypasses all of that!!! Crazy...

joezydeco 3y ago
I'm a little confused. Does the code get generated on any attempt to log in, or only those that have the password and MFA is activated? Or when someone attempts password recovery? Because I'm a bit concerned if Microsoft passwords are leaking.
- laurencei 3y ago
  When attempting to login to your Microsoft account, instead of typing your password you can do an optional "one time password" generation thing from Microsoft. So instead of typing your password +2FA - they email you a 6 digit "one time password" that you can use instead. You cant disable this. So all Microsoft accounts could have a daily 1 in 1 million chance of been overtaken. Odds are low - but if you then spam this across thousands of attempts per day - they would statisically "get lucky" from time to time...
  - joezydeco 3y ago
    That makes much more sense, thanks. I'm guilty of using this from time to time as well.
  - firebat45 3y ago
    One would think Microsoft wouldn't be stupid enough to provide endless amounts of one time codes for a single account. I would guess they provide 5-10 codes before escalating the login.
nitwit005 3y ago
If you have 500 million accounts you know of, you'd be breaking into around 500-1000 a day. I suppose that's a decent rate, but it feels like most Microsoft accounts will just have something like Office or Minecraft set up.

SeasonalEnnui 3y ago

Have you got an exchange email or Teams set up on a mobile device? These will generate 2FA requests (but not make any kind of notification on the device).

alaxapta7 3y ago

I thought this was the Passwordless account they implemented (EDIT: didn't realize you weren't talking about the Authenticator app), but I had it turned off. I somehow managed to make it stop by re-enabling/re-disabling both Passwordless and 2FA. So now they always ask me for a password and then I get the challenge. To this day, I can't comprehend how this is supposed to be safe. So someone can just type in my username and wait until i eventually misclick in the Authenticator app? If it was from a browser I have used before at least, but I was getting these challenges from around the globe.