Current MFA fatigue attack campaign targeting Microsoft Office 365 users
The problem here is MS's terrible MFA & "SSO" implementations. If I didn't need to MFA multiple times per day into Azure¹ (i.e., if I could sign in truly once per, say, 24 hours), and if MFA was just a literal MFA², the fatigue would not be so incredibly high to begin with. Solutions like a Yubikey Nano are going to seem like future tech to anyone that has to put up with MS Authenticator.All of the articles suggestions just seem to make more work for the alright overburdened user. Fixing the fatigue at its root is what is needed. (But the article is oddly targeting administrators, for whom such a fix is impossible, not … MS themselves.)¹different Azure tenants, despite being tied sort of to the same user, require separate MFA/auth sequences. In a separate AAD tenant, my user is technically separate, but also technically not; best I understand it is that it is sort of like a shadow user ("guest", in AAD) to my real user. AAD knows they're connected … but not well enough to matter for MFA.²MS Auth requires a double PIN entry on the phone in order to respond to an MFA. It used to be you could just tap the notification, but at some point, that got axed, and the fatigue went up like 3x. MFA is supposed to be proof of possession (I have the phone), not proof of knowledge (password, pin). An non-pin-protected notification is fine; the password still covers the "what you know".