Authentication flow bug allowing anyone to spam Authenticator notifications without the correct password

Question

For weeks now I have been getting 10-20 Authenticator notifications every single day for sign in requests that are not from me. There are hundreds of posts regarding this issue on this forum, Reddit and elsewhere. An attacker should not be able to trigger an MFA request without the correct password. I understand not wanting to indicate to the attacker that they have the correct password, but you can easily do that without actually triggering an Authenticator notification on the target's device.

Please fix this incredibly annoying bug that is clearly affecting a large segment of your userbase.

Answer 1

It's not a bug, it's an unintended logical trap, since there are Passwordless account users using the authenticator app who must be able to recover their accounts without the password requirement, along with possibly other similar issues that may affect particular account utilities.

However, there's a security by obscurity workaround for this issue that though not foolproof, typically works to resolve it permanently assuming your devices are secure with no infostealer malware and you're careful about not exposing the item that must be changed.

The basic steps are to create a new account email alias (or use an alternate existing one if you have it), then make that 'new' alias the Primary, select Change sign-in preferences to switch to that screen and uncheck the original email alias so it can no longer be used for login by either you or the attackers.

Manage how you sign in to your account

Do NOT delete the original alias, since you'll want to keep that to continue to receive and send email to others, while you should never use the 'new' alias for that purpose to keep it hidden and not potentially expose it to future attacks.

The above is security by obscurity because it doesn't guarantee the new alias won't be exposed via something like an infostealer malware, but it at least typically stays private as long as you never intentionally provide it to others.

You must, of course, also remember the new alias since the old one will no longer work, though in many cases you could likely use the typically existing phone number alias as well, though if the attacks continue even after the above changes have been made, it's probably worth temporarily unchecking the phone number alias as well to confirm that's not what the attackers were actually abusing.

Rob