Hacker News Reader

Comment by smcl | Hacker News Reader

Funny, with the rise of MFA various Authenticator apps are installed on our phones. Some applications (I'm looking at you, Outlook) will randomly shit themselves and request I hit a button in the app a few times per day, otherwise I'll not receive emails or meeting requests. I can easily see this completely defeating the purpose of MFA by numbing people into automatically accepting these notifications.

View on HN

I think the problem isn't limited to Microsoft Outlook but to anything bound to ActiveDirectory: Randomly, sometimes multiple times per day, sometimes not for a week, Teams, WebEx and Office365 will re-reqest credentials. In some cases they continue to work even if you ignore the prompts, sometimes they don't...

Ok, good to hear it's not just me.

We've recently been aquired and the new company uses Outlook. I can't use the desktop app as it constantly asks me to go through the full authentication process. I have to use the web interface which is just fine for me as I mostly use macOS native apps for mail and calendar. I only use outlook to report phishing emails.

This happens with google too (though thankfully much less often): when it expires your credentials, it could be for mail, calendar, drive, meet, etc., it all redirects to just a generic "log into google" form, with no mention even of what you're logging into, to allow you to remember, "ah yeah, I had a docs tab open".

I think password managers matching domains with credentials might help a little here, but it normalizes finding random tabs with "google" asking for creds down below the point of noise. It often happens right as I log in in the morning to go into my first meetings, and I'm rushed.

Somewhere, someone has likely exploited this by now.

That one has an easy solution: dump google.

Reply on news.ycombinator.com