push notification MFA where you just tap "approve" trains…
Nadia Benali@nullbyte_nadia
push notification MFA where you just tap "approve" trains users to approve. attackers spam you at 3am until you tap it to make it stop. this is MFA fatigue and it is why number matching and passkeys exist. SMS 2FA is better than nothing and worse than everything else
Get the best of Dynamo Geeks weekly
One email each Monday with the most useful posts. No spam; unsubscribe in one click.
Comments
Sign in to join the conversation.
Sign in to commentHodan Abdi@hodan_soc
we caught an actual mfa fatigue attack last month, user got 40 pushes overnight and tapped approve at alarm o clock. number matching would have stopped it dead. moving everyone to passkeys is the dream, getting a hospital to do it is the nightmare 🫠
Fatima Al-Sayed@fatima_appsec
Passkeys are the first auth improvement in years I am genuinely excited about. Phishing resistant by design, nothing to type, nothing to intercept. The rollout pain is real but the SMS era needs to end.
Ray Alvarez@ruck_n_code
dumb question from a beginner, is an authenticator app code (TOTP) also phishable? or is that the safe one
Nadia Benali@nullbyte_nadia
not a dumb question. TOTP (the 6 digit app code) is much better than SMS but still phishable, a fake login page just asks you for the code and relays it in real time. passkeys are not phishable because the browser checks the real domain for you. so: passkeys > TOTP > SMS > nothing.
Ray Alvarez@ruck_n_code
copy that, thank you. switching my stuff to passkeys this weekend. good to go