this post was submitted on 07 Sep 2026
176 points (98.9% liked)

Technology

87897 readers
4377 users here now

This is a most excellent place for technology news and articles.

Our Rules

  1. Follow the lemmy.world rules.
  2. Only tech related news or articles.
  3. Be excellent to each other!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
  9. Check for duplicates before posting, duplicates may be removed
  10. Accounts 7 days and younger will have their posts automatically removed.

Approved Bots

founded 3 years ago
MODERATORS
L3s@lemmy.world
enu@lemmy.world
technopagan@lemmy.world
L4s@lemmy.world
L3s@hackingne.ws
176
Microsoft Authenticator Spams Sign-In Requests Without Even Needing Your Password - André Klein Dot Net (andreklein.net)
submitted 13 hours ago by lemmydividebyzero@reddthat.com to c/technology@lemmy.world
29 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] frongt@lemmy.zip 12 points 9 hours ago (3 children)

Microsoft can’t properly gate a push notification behind a password check?

Careful now. If you put the MFA prompt after the password, it works as confirmation that you have the correct password even if you're not able to log in. You don't want to give that confirmation to the attacker. That's why MFA happens before the password is validated.

[–] lemmydividebyzero@reddthat.com 3 points 5 hours ago* (last edited 5 hours ago)

You don’t want to give that confirmation to the attacker.

That's how it works on > 90% of the websites on the internet. And that's usually not a problem, because one usually does not suddenly know the password of other people.

[–] bitwolf@sh.itjust.works 2 points 6 hours ago

Just require the TOTP at the start of the form. It's that simple.

[–] Natanael@infosec.pub 3 points 8 hours ago

Just set a timer after entering the password in every single case (only stopped early by successful MFA). "authentication did not succeed, one or more factors may be incorrect or may have failed verification"