News for hackers. Stuff that matters.

A comment on What Apple and Google are doing to your push notifications. Parent comment

Re:What Apple and Google are doing to your push notifications by hunter2_ on Wednesday May 27, 2026 @09:39PM (#48303266)
I recently got an unsolicited OTP email from Microsoft, which led me to fear that someone had entered my password, but no: I eventually was able to confirm that the arrival of an OTP does not, in fact, require that someone enter anything beyond my email address. This is rather insane (I should not be having a blood pressure event due to Microsoft) but on the other hand I do understand the passwordless concept which is just a password-reset flow sans password-change. Perhaps a nice middle ground would be if the OTP email explicitly stated that my password was not entered.
[ Parent | on HN ]
Re:What Apple and Google are doing to your push notifications by xocnad on Thursday May 28, 2026 @06:52AM (#48307183)
This also happened to me about a week ago and I had the same reaction/discovery process you did. OT but I wonder if there was a recent ramp up in these attacks. It was done against an email I do not regularly use that was attached to my account as an alternate and haveibeenpwned confirmed was in a data breach back in 2020.
[ Parent | on HN ]
Re:What Apple and Google are doing to your push notifications by hunter2_ on Friday May 29, 2026 @04:35AM (#48320630)
I had been thinking someone with a similar address made a typo. But now I'm thinking Microsoft already considers this a known incident depending on whether a bazillion attempts were made in a detectable manner. I hope a successful launch at least demands a botnet and random delays/backoff.
[ Parent | on HN ]
Re:What Apple and Google are doing to your push notifications by projektfu on Thursday May 28, 2026 @08:55AM (#48308278)
Some providers (looking at you, Intuit) don't seem to understand TWO factor authentication and will allow someone to bypass your password if they can intercept the SMS or email, and treat it as a normal login.
[ Parent | on HN ]
Re:What Apple and Google are doing to your push notifications by hunter2_ on Friday May 29, 2026 @04:45AM (#48320681)
I can imagine an evolution like:

1. Introduce passwords

2. Introduce email-based reset flow

3. Introduce 2FA (optional)

4. Someone says "take the password reset flow, trigger it automatically when a user tries to log in and has only given their email, hide the password field during login, and after the email is validated drop the user back to their previous journey instead of having them set a new password"

5. You see #4 as #3 failing, but when #3 was never applied it's not quite that. Aside: making #3 mandatory would be smart.

[ Parent | on HN ]
Re:What Apple and Google are doing to your push notifications by projektfu on Friday May 29, 2026 @04:44PM (#48328990)
It's Intuit's normal login flow. Enter username and it then says enter password or click here and we'll text/e-mail you a code. Ironically, if you use a password it will often text you a 2FA code.
[ Parent | on HN ]