posted in Technology
Microsoft Authenticator Spams Sign-In Requests Without Even Needing Your Password - André Klein Dot Net
andreklein.net/microsoft-authenticator-spams-sign-in-requests-without-even-needing-your-password/Replying to @lemmydividebyzero@reddthat.com
Microsoft can’t properly gate a push notification behind a password check?
Careful now. If you put the MFA prompt after the password, it works as confirmation that you have the correct password even if you’re not able to log in. You don’t want to give that confirmation to the attacker. That’s why MFA happens before the password is validated.
Replying to @frongt@lemmy.zip
You don’t want to give that confirmation to the attacker.
That’s how it works on > 90% of the websites on the internet. And that’s usually not a probably, because one usually does not suddenly know the password of other people.