Hacker News Reader

Comment by onaworkcomputer | Hacker News Reader

Don't you have to provide some information as part of the confirmation? Whenever something requests MFA, it will show a two digit number, and in the Authenticator app, I will be presented with three numbers and can only confirm the prompt if I select the same number that was shown by the requestor. My work MSFT account is even more locked down and requires me to type in the number.

View on HN

No, if you are on iPhone, Face Id authenticates, then you press a button to allow. That's it. There is no number to type anywhere.

Oof. I wonder if admins can disable push notifications and just fall back to TOTP instead? Though it does sound like that would not be convenient if you have to enter a TOTP every time an RDP connection get interrupted.

... you can still do the code based flow if you want...

I want to see what the execs use, not the code monkey "requirements"

For Office365 / AzureAD this is a configuration choice, admins can enable the numbers option which reduces the chances of accidental allows

Sorry but the parent poster is correct. For both my corp account as well as my personal Microsoft account , I’m prompted to enter the validation number after I’ve faceid’d. If this doesn’t happen when you are authenticated, then it’s a setting with the system you’re logging into.

Same here. We disabled the push notification for Corp, but my personal account requires me to select a matching value.

Administrators can enable it. If they have it set to 'Microsoft managed', number entry is enabled by default but not additional context. https://docs.microsoft.com/en-us/azure/active-directory/auth...

Depends on config. Bare minimum (mainstream?) is just a "blah blah service login" Accept|Deny.

If you are in and out administering things and accessing protected documentation I could see how the login-to-mfa-popup latency and difference in tenancy names could give a window for a misclick.

Duo also works this way

Reply on news.ycombinator.com