[drop_cap]I[/drop_cap]’ve recently migrated all my work machines from Windows to Linux because I finally grew tired of Microsoft’s adware nonsense. And yet, they still managed to throw a wrench into my workflow. As many of you know, Microsoft has their own little “Authenticator” app that acts as an MFA gateway. When you sign in to […]
  • frongt@lemmy.zipEnglish
    164·
    11 days ago

    Microsoft can’t properly gate a push notification behind a password check?

    Careful now. If you put the MFA prompt after the password, it works as confirmation that you have the correct password even if you’re not able to log in. You don’t want to give that confirmation to the attacker. That’s why MFA happens before the password is validated.

    • lemmydividebyzero@reddthat.comOPEnglish
      8·
      11 days ago

      You don’t want to give that confirmation to the attacker.

      That’s how it works on > 90% of the websites on the internet. And that’s usually not a problem, because one usually does not suddenly know the password of other people.

    • Natanael@infosec.pubEnglish
      31·
      11 days ago

      Just set a timer after entering the password in every single case (only stopped early by successful MFA). “authentication did not succeed, one or more factors may be incorrect or may have failed verification”