This is also why basically all GDPR consent trackers are "accidentally" so forgetful about your choice not to consent. You need to say no every single time (with potentially shifting interfaces). Similarly if I remember correctly WhatsApp would repeatedly ask you to accept the new terms of service with pop-ups until you one day accidentally mis-click on the consent button. I honestly don't understand how that would count for anything, legally speaking. But don't expect much help from the legal system here - think of how often we have said no to EARN IT, yet it keeps coming back. One slip though and you're stuck with it.

Just like the IRA said to Thatcher: "Today we were unlucky, but remember we only have to be lucky once. You will have to be lucky always."

Whatsapp also helpfully nags you constantly to enable notifications if they’re disabled and to enable (unencrypted) backups to the cloud.

This is illegal under GDPR, but enforcement is currently overwhelmed with violators.

>This is also why basically all GDPR consent trackers are "accidentally" so forgetful about your choice not to consent

They're perfectly entitled to track you as long as you don't opt out.

And when you opt out, they can't be held responsible for remembering it for even an instant, because they can't identify you.

"That's some catch, that Catch-22"

Yeah, one website I visited recently helpfully showed me the cookies that it would save if I accepted their cookie agreement. The first one on the list was the cookie to remember my response to their cookie agreement.

This also makes the cookie prompts a pain for users who don't use cookies. My browser rejects all cookies by default, so I end up creating uBlock filter rules for the prompts on sites I frequently visit.

> They're perfectly entitled to track you as long as you don't opt out.

This is false, GDPR is opt-in.

Irrelephant.

Since you didn't opt in, you haven't allowed them to track you, and they can't remember that you didn't opt in without tracking you.

See?

> They're perfectly entitled to track you as long as you don't opt out.

Um ... huh? GDPR requires explicit consent.

Yeah I also accident accepted the WhatsApp terms after months of periodically denying, and I feel raped.

Airtable did something similar recently with the grandfathered free accounts

Thank you for downvoting me, airtable marketing crew lol

The solution is obviously to not show a notification at all, ever.

If I'm trying to log in, I know that I have to go into Authenticator and approve, so just check if there are outstanding requests (e.g. with a 2 minute timeout) when I open the app.

Except that's still a failure: the attack can script that to ensure there's always a notification. Doesn't have to get it right then and there either - they have infinite time. Might be this month, might be next month.

The user interaction of classic TOTP forms an important grounding function: it forces (in most cases) spatial locality of the user and the device being interacted with.

Some providers also give a unique identifier to each request. I always check them if it's present. Also, having multiple selections (numbers) also prevents this attack somehow. Your prompt says 7/56/9, but neither is there. So what? Or, you have the number in your prompt by chance, and it's not the right choice for that prompt.

Nevertheless, at the end of the day the buck always stops at the user. User have to be diligent and shall have no blind trust on anyone/anything.

If a hacker uses my account to hack my employer via Microsoft's terrible MFA, it's not my problem. The buck stops, as always, with the person who cares about the resource being accessed, or who is made to care by being legally liable.

For a disgruntled employee (most employees), getting hacked is a win-win.

That's an interesting take.

Let's change names.

What if it's Google, Blizzard / Epic (Battle.net), and something personal? These services use the same flows.

Or worse, what if it's your e-Government app, and you lose all your identifying information and somebody can become "you" with all the information they got?

Will you say "Meh, it's a personal account, and I gave access via MFA, but who cares, it's not my problem?".