News for hackers. Stuff that matters.
Re:Flaw has Microsoft Authenticator overwriting MFA accounts... by underwater on Saturday August 17, 2024 @11:07PM (#41279854)
I had this with Duolingo. Their login fails if the browser can’t connect to recaptcha.net. But it just shows a generic “incorrect username/password” message.
Re:Flaw has Microsoft Authenticator overwriting MFA accounts... by dataflow on Sunday August 18, 2024 @12:40AM (#41280169)
In my case I'm pretty darn sure it's something on their backend. Some race condition or lock or something that prevents login while stuff is being updated. The most frustrating part is the gaslighting, not the failure.
Re:Flaw has Microsoft Authenticator overwriting MFA accounts... by Garlef on Sunday August 18, 2024 @02:49AM (#41280623)
Or it could be bad UX, displaying the same error message for two different errors.

(Not saying that simplifying several errors into one message is always bad. I think it's reasonable to just return a 500 without any info for everything that's caused by an unexpected exception on the backend.)

Re:Flaw has Microsoft Authenticator overwriting MFA accounts... by cbzbc on Sunday August 18, 2024 @03:58AM (#41280876)
Or a backend cache miss
Re:Flaw has Microsoft Authenticator overwriting MFA accounts... by qingcharles on Sunday August 18, 2024 @03:30PM (#41284764)
Ah, this is a good debug. I wonder how many times this is silently happening on other sites?
Re:Flaw has Microsoft Authenticator overwriting MFA accounts... by BlueTemplar on Sunday August 18, 2024 @03:55PM (#41284922)
Very common, the first thing I check when this kind of error pops up.