Microsoft's new-ish Authentication for login (ready for spamming?)

  • DNS Benchmark v2 is Finished and Available!
    Guest:
    That's right. It took an entire year, but the result far more accurate and feature laden than we originally planned. The world now has a universal, multi-protocol, super-accurate, DNS resolver performance-measuring tool. This major second version is not free. But the deal is, purchase it once for $9.95 and you own it — and it's entire future — without ever being asked to pay anything more. For an overview list of features and more, please see The DNS Benchmark page at GRC. If you decide to make it your own, thanks in advance. It's a piece of work I'm proud to offer for sale. And if you should have any questions, many of the people who have been using and testing it throughout the past year often hang out here.
    /Steve.
  • Be sure to checkout “Tips & Tricks”
    Dear Guest Visitor → Once you register and log-in please checkout the “Tips & Tricks” page for some very handy tips!

    /Steve.
  • BootAble – FreeDOS boot testing freeware

    To obtain direct, low-level access to a system's mass storage drives, SpinRite runs under a GRC-customized version of FreeDOS which has been modified to add compatibility with all file systems. In order to run SpinRite it must first be possible to boot FreeDOS.

    GRC's “BootAble” freeware allows anyone to easily create BIOS-bootable media in order to workout and confirm the details of getting a machine to boot FreeDOS through a BIOS. Once the means of doing that has been determined, the media created by SpinRite can be booted and run in the same way.

    The participants here, who have taken the time to share their knowledge and experience, their successes and some frustrations with booting their computers into FreeDOS, have created a valuable knowledgebase which will benefit everyone who follows.

    You may click on the image to the right to obtain your own copy of BootAble. Then use the knowledge and experience documented here to boot your computer(s) into FreeDOS. And please do not hesitate to ask questions – nowhere else can better answers be found.

    (You may permanently close this reminder with the 'X' in the upper right.)

lmcarmona

New member
Jan 16, 2026
3
0
Hello,
I was trying to figure the way out to submit to Steve directly, but couldn't figure it out on the GRC site.
Anyhow, hope he sees this.

I recently started to get Microsoft Authenticator MFA notifications for my Outlook account on my iOS App on my iphone. After I got two notifications, I thought I better change my password, so I did. After a week, I got a few more in one day...then I started to research a bit. I came across a reddit article that mentioned MS no longer requires you to input a password to send the MFA notice. Reading this, I was surprised but then started to realize that I have seen this also this last half year if not at least in the last few months, but at the time I thought it was cache or cookie memory that caused this....nope, after testing this from a co-workers phone I have never ever used - we went to outlook.com, input my email address. It automatically sent the MFA notification WITHOUT needing the password anymore.

I feel as this is NOT a good move with as much spam that goes out with text/emails and phone calls...now they can spam MFA notifications out to users as long as they have your email now.

I think having to enter the password BEFORE the MFA is sent is less convenient...but stops spam MFA messages going out to a person's phone from a malicious character.

Since then I have now turned off allowing notifications from the MS Auth App on my iphone. I go into the app and refresh when I am logging in now to stop any notifications from false login attempts.

I do feel bad for those users/people who might not understand what is happening here and one day will accidently click the right number that pops up in the MFA notification and let the bad actor into their account without needing their password.

Anyhow, just thought this was an odd decision on Microsoft's part.
To be fair, you do have to select a number out of 3 options on the pop up (and you also have the "deny" option), but that is a 25% chance you accidently pick the right one that will let the malicious person in, instead of ignoring it or selecting deny.

Thank you and maybe this post if not seen by Steve will be seen by others who it might help.
 
Wow. I hope they have some throttling on sending the MFA notifications in case some bot goes nuts and does hundreds/thousands of calls in a short time.

Are these the 2FA prompts you are receiving?

I use 2FA TOTP on my Microsoft account, and don't get any prompts or even emails. I tried to replicate your scenario and wasn't able to.
 
Hmmm, I don’t remember doing that but honestly I might have, I’ll do some poking around. I did read others have said they have to disable MFA to remove it but guess I’ll do some more poking around. Guess it’s a learning moment and maybe I jumped the gun. I’ll come back after poking around.
 
Ok I verified I do NOT have passwordless enabled but if no one else is seeing this then who knows. Anyhow just thought I’d put it out there in case others start seeing or getting mfa notifications thinking their passwords have been compromised.
 

Attachments

  • MS Account.png
    MS Account.png
    36.9 KB · Views: 78