9 ms·
MFA via push notifications is vulnerable to the "keep spamming them until they tap allow" attack. You can make the user type a code (like Apple does), but that'
by rollcat 3y ago
MFA via push notifications is vulnerable to the "keep spamming them until they tap allow" attack. You can make the user type a code (like Apple does), but that's it for convenience.
- jcrawfordor 3y agoMicrosoft allows the administrator to configure either "select one of three" or have the user enter a two-digit code. The default is "select one of three," but there is also some risk scoring to tune which mode a user gets.
- WirelessGigabit 3y agoOffice 365 for Business now has 'enter 2 digits' whereas the personal one defaults to 1 out of 3.
- jmprspret 3y agoThey also don't work at all when there's a network outage and you have no mobile data on your phone. (Whereas TOTP would work). An issue I have run into before.