Flaw has Microsoft Authenticator overwriting MFA accounts, locking users out

Re:Flaw has Microsoft Authenticator overwriting MFA accounts... by bongodongobob on Sunday August 18, 2024 @12:10AM (#41280073)

> Mandatory password change intervals.

Hasn't been best practice for a decade.

> Insane rules for constructing passwords.

There needs to be a minimum standard. Generally length is enough, but the special character type stuff is annoying.

> Completely undocumented password requirements that you just have to figure out by trial and error.

I haven't come across this.

> Complicated error messages full of security jargon. "Secret Questions" that you can't remember the answers to.

That's a you problem.

Y'all complain about password breaches but want to use Mypassword69! for everything. Pick a lane.

[ Parent | on HN ]

Re:Flaw has Microsoft Authenticator overwriting MFA accounts... by smohare on Sunday August 18, 2024 @12:25AM (#41280121)

I encounter some bogus undocumented password constraints probably half the time I create an account. Usually it is a maximal length requirement that is not mentioned in the error message.

Don’t defend these idiotic practices.

[ Parent | on HN ]

Re:Flaw has Microsoft Authenticator overwriting MFA accounts... by pasquinelli on Sunday August 18, 2024 @01:16AM (#41280265)

password too long is such a stupid reason to reject a password

[ Parent | on HN ]

Re:Flaw has Microsoft Authenticator overwriting MFA accounts... by bongodongobob on Sunday August 18, 2024 @01:14AM (#41280254)

I'm not. The only time I've seen a maximum length password was like 10 years ago on Dell's IDRAC I think? I just don't think the complaints being thrown out here are good arguments.

[ Parent | on HN ]

Re:Flaw has Microsoft Authenticator overwriting MFA accounts... by tsimionescu on Sunday August 18, 2024 @02:18AM (#41280493)

Look at Microsoft's personal accounts (live.com or whatever they are calling it this week) - they still have this limit.

[ Parent | on HN ]

Re:Flaw has Microsoft Authenticator overwriting MFA accounts... by pasquinelli on Sunday August 18, 2024 @01:20AM (#41280283)

i just had it happen day before yesterday to create an account for a service to do a background check for a new job. it rejected my password without saying why and i could only get past it by shortening it to 15 characters.

and then the deeper question is, why do i need to create an account for this?

[ Parent | on HN ]

Re:Flaw has Microsoft Authenticator overwriting MFA accounts... by bongodongobob on Sunday August 18, 2024 @01:39AM (#41280346)

Not defending the max length, that's stupid and probably some old AS400 thing that got built into the system, but the account is for auditing obviously.

[ Parent | on HN ]

Re:Flaw has Microsoft Authenticator overwriting MFA accounts... by pasquinelli on Sunday August 18, 2024 @04:54PM (#41285424)

i don't see what's obvious. what is being audited? why is my email address needed when i'm giving them my id and ssn?

[ Parent | on HN ]

Re:Flaw has Microsoft Authenticator overwriting MFA accounts... by troupo on Sunday August 18, 2024 @01:15AM (#41280256)

> but want to use Mypassword69! for everything

That... That is literally what these "security practices" force you to use. You literally used an example of the ubiquitous "at least one uppercase letter, one special character, and one digit" requirement

[ Parent | on HN ]

Re:Flaw has Microsoft Authenticator overwriting MFA accounts... by bongodongobob on Sunday August 18, 2024 @01:33AM (#41280323)

And I think that's fine. Unless you're going to ask for 24 character passwords. Pick one.

[ Parent | on HN ]

Re:Flaw has Microsoft Authenticator overwriting MFA accounts... by maratc on Sunday August 18, 2024 @07:42AM (#41281731)

correcthorsebatterystaple is 25 characters though.

[ Parent | on HN ]

Re:Flaw has Microsoft Authenticator overwriting MFA accounts... by gpvos on Sunday August 18, 2024 @05:43AM (#41281294)

> Hasn't been best practice for a decade.

This entire thread is about places that clearly have no clue about best practices.

> I haven't come across this.

You sweet summer child...

[ Parent | on HN ]