Security Now - #1019 - re Password stuffing - Microsoft

[Hawkmeister]

The 'Microsoft / Hotmail account password Stuffing attempts..." entry (starting on the PDF page 14) intrigued me. I found similar results. Evidently 'I' had tried to login in the last 24 hours from: Algeria, Russia, United States, Senegal, Ukraine, UK, Morocco, Bangladesh, Brazil, Germany, Belarus, Oman, Colombia, Jordan, India.

I'm curious: Does Google / Yahoo / banking sites provide their users that type of feedback?

GeoFencing (with the ability for authenticated logins to adjust the fence) should be managed, and I believe failed attempts should be tracked and patterns of abuse reported to authorities.

 

[miquelfire]

My Google account will send me emails when I log in for the first time somewhere (There are no cookies that will tell Google I was logged in before), but if someone can log into my account, there's a bigger issue in that they found a way to bypass the YubiKey requirement. I do need to double-check if Passkey require YubiKey or not.

With my bank, it requires a code from my text or email to make it sure it's me when I first log somewhere. Now, if they're just "brute forcing" my bank's password, they likely don't know my phone number, so they can't just clone it.

If they happened to have my phone number and need to contact tech support to get an in to clone my texts, they'll need to be logged into my Google account anyway, as I'm a Google Fi user. Not counting on them needing tech support though.