News for hackers. Stuff that matters.

A comment on Recent 'MFA Bombing' Attacks Targeting Apple Users. Parent comment

Re:Recent 'MFA Bombing' Attacks Targeting Apple Users by asd4 on Wednesday March 27, 2024 @08:45AM (#39838316)
The security researcher in the article was concerned about accidently confirming the prompt on his watch.

I don't think its a matter of being "smart enough". Human error can easily creep in when dismissing 10's or 100's of prompts.

[ Parent | on HN ]
Re:Recent 'MFA Bombing' Attacks Targeting Apple Users by hunter2_ on Wednesday March 27, 2024 @10:18AM (#39839462)
The prompt UX should step into a special "bombed" mode when a frequency threshold is crossed, at which point accepting a prompt has fat-finger protection such as double confirmation steps, and declining all (or perhaps all that share a commonality, like same initiating IP address) becomes possible.
[ Parent | on HN ]
Re:Recent 'MFA Bombing' Attacks Targeting Apple Users by lazide on Wednesday March 27, 2024 @10:52AM (#39840017)
Or you know, not allow this kind of brute forcing at all?
[ Parent | on HN ]