Flaw has Microsoft Authenticator overwriting MFA accounts, locking users out

Re:Flaw has Microsoft Authenticator overwriting MFA accounts... by meroes on Saturday August 17, 2024 @03:43PM (#41277341)

So far https://studentaid.gov/ is the worst I've come across (I don't want to enter fake info^ and I can't duplicate my account to double check the requirements). From memory it was something like:

1) No words! 2) Can't reuse last 24 passwords 3) Excludes some special characters 4) 5 Security questions 5-10) Several other password requirements

Are the security questions case sensitive? Who knows.

^ "I understand that I’ll be required to certify that the information I provide to create an account is true and correct and that I’m the individual I claim to be. If I’m not the person I claim to be, I understand that I’m not authorized to proceed and that I should exit this form now. If I provide false or misleading information, I understand that I might be subject to a fine, prison time, or both."

[ Parent | on HN ]

Re:Flaw has Microsoft Authenticator overwriting MFA accounts... by lostlogin on Saturday August 17, 2024 @04:21PM (#41277646)

> If I provide false or misleading information, I understand that I might be subject to a fine, prison time, or both

Enter your password wrong and you're off to jail?

[ Parent | on HN ]

Re:Flaw has Microsoft Authenticator overwriting MFA accounts... by thaumasiotes on Sunday August 18, 2024 @03:26AM (#41280758)

Might, not will.

[ Parent | on HN ]

Re:Flaw has Microsoft Authenticator overwriting MFA accounts... by wizzwizz4 on Saturday August 17, 2024 @04:39PM (#41277778)

Hopefully "Fakename Q Notarealperson" won't get me arrested… Here's the password help message:

---

Your password must be 8 to 30 characters in length and must contain at least one uppercase letter, one lowercase letter, and one number.

Your password is case-sensitive.

You can’t use personal identifiers such as your first or last name, date of birth, or Social Security number in your password.

---

Here are some error codes the API returns:

  ["NULL_USERNAME", "NULL_EMAIL", "PWD_ILLEGAL_CHARACTERS", "PWD_CONTAINS_SPACE", "NULL_CHALLENGE_QAS"]

The UI doesn't expose the password error codes. It just says “You entered an invalid response. For more info, select the help (?) icon.” (The NULL_USERNAME and NULL_EMAIL errors seem to be spurious in this context.)

[ Parent | on HN ]

Re:Flaw has Microsoft Authenticator overwriting MFA accounts... by meroes on Saturday August 17, 2024 @04:46PM (#41277825)

Hmm I just made an account two days ago and it told me no words allowed in the own. The email link they sent me to sign up no longer works, so maybe they changed something?

[ Parent | on HN ]

Re:Flaw has Microsoft Authenticator overwriting MFA accounts... by jagged-chisel on Saturday August 17, 2024 @04:58PM (#41277904)

So I had to guess that spaces weren't allowed?

[ Parent | on HN ]

[dead]

Re:Flaw has Microsoft Authenticator overwriting MFA accounts... by notpushkin on Sunday August 18, 2024 @10:59AM (#41282761)

If only the UI did display anything useful here too!

[ Parent | on HN ]

Re:Flaw has Microsoft Authenticator overwriting MFA accounts... by mejthemage on Sunday August 18, 2024 @08:52AM (#41282084)

Reminds me when my daughter made her Roblox account. They had some rule "don't use your real name" but they never asked her for her real name, so couldn't validate. They would arbitrarily fail a lot of chosen usernames that were made up fake names.

When she tried a variation of "Taylor Swift" it worked fine.

[ Parent | on HN ]

Re:Flaw has Microsoft Authenticator overwriting MFA accounts... by globalise83 on Sunday August 18, 2024 @02:31AM (#41280553)

Stud3ntA1d24 here we come!

[ Parent | on HN ]