Severe MFA push spam on Microsoft consumer account 2

Question

Hello,

I am getting around 50 MFA spam per day from all over the US. I read Microsoft's answer on another post, but I don't want passkey or other method as they are device stored and I am a nomad : I carry all my devices with me, and my entire life with me. This is not a secure approach.

The MFA prompt should ONLY be triggered on a good password attempt, and my password is like 70 characters long with numbers, special characters, upper and lower case, I did change it multiple times... This means that you are spamming an MFA on failed attempts. YOU need to fix this. It's not about the user, it's about Microsoft. Thanks.

Answer 1

First, you're incorrect that passkeys are insecure for authentication on multiple devices, because they're phishing-resistant and the private keys used to protect the passkeys are stored within either the Windows 10/11 supported TPM, Google's Titan M or similar encrypted module that performs the computations necessary, rather than providing the secure information itself directly to the insecure code portions of the device. Only the Public key is sent outside the TPM portions of the device, and these are only useful on and from that specific device, since they're linked to the Private key stored within.

The only method known to bypass passkeys is via MiTM attacks that capture and abuse the device authentication directly, which since most other current forms of 2FA are phishable (i.e. the user can be tricked into providing them to an attacker who can use them from another device), they're really all less secure than passkeys.

However, I'll still provide the answer to the original question, which is really much simpler and more obvious than the above.

The answer to how this can happen is quite simple and actually a logical trap that Microsoft set for itself with multiple security decisions made over the years.

The problem is that Microsoft's push to allow passwordless login using the Authenticator or other similar methods means that there must inherently be an ability to recover the account using only the username (email alias), combined with one or more of these alternative verification methods.

That means that once an attacker has collected your email address via any method, including either online posting or someone else's communications with you, let alone an online breach or malware, they can leverage that information to perform automated bot attacks against Microsoft's own infrastructure to generate these repetitive authentication attempts.

However, there's a relatively simple solution, though its technically security by obscurity, by simply adding a new alias email address (e.g. somethingelse @ outlook.com) and making that the Primary alias, then unchecking the original alias in 'Change sign-in preferences', but keeping that address for continued use for email purposes.

Change the email address for your Microsoft account | Microsoft Support

This last part is important, since you'll only want to use the 'new' alias for authentication and nothing else, keeping it entirely to yourself, while continuing to use the original alias for email or other external purposes like 3rd-party account verifications. This is the security by obscurity portion, since if the new alias somehow became exposed the attacks might start again, but it's unlikely as long as you are careful not to expose that address to others.

Rob