For the record you should probably change your password. That way they can’t even try.
this post was submitted on 03 Aug 2024
18 points (95.0% liked)
Cybersecurity
5845 readers
48 users here now
c/cybersecurity is a community centered on the cybersecurity and information security profession. You can come here to discuss news, post something interesting, or just chat with others.
THE RULES
Instance Rules
- Be respectful. Everyone should feel welcome here.
- No bigotry - including racism, sexism, ableism, homophobia, transphobia, or xenophobia.
- No Ads / Spamming.
- No pornography.
Community Rules
- Idk, keep it semi-professional?
- Nothing illegal. We're all ethical here.
- Rules will be added/redefined as necessary.
If you ask someone to hack your "friends" socials you're just going to get banned so don't do that.
Learn about hacking
Other security-related communities [email protected] [email protected] [email protected] [email protected] [email protected]
Notable mention to [email protected]
founded 2 years ago
MODERATORS
Some Microsoft services don't ask for your password anymore, they just send you a code to your register email.
Yeah it turns out that's what nonsense this is.
Worse, I sure as crap never opted into this, but at least you can turn it off.
What a stupid decision some product manager made.
Passwordless is the best.
Not when that password is just an email...
❤️ Passkeys.
The thing that I have seen is while it looks like they are after MFA codes, those emails are a distraction from the actual account they are trying to take over, so be very careful when deleting the emails, there could be a legit email in there asking you to roll back an account change.
I've been getting these for an account even I can't get back into.
Gonna have to get real granular with my inbox filters to send them into the void...
Dosen't Microsoft rate limit the attempts? In that case ypu can just select a random number, the trie to brute force it until the code send is the one selected.
It doesn't seem all that limited; I'll get 4-5 in a burst, then nothing for a couple of hours or a day or so, then 4-5 more, and so on.
Been ongoing for a couple of months now, and given it's a random 6 digit number, I don't think they're even remotely doing enough attempts to try to brute force it.
If Microsoft accepts, let's say, 3 attempts per code send, they already tried 1200 numbers (per your 400 emails), it's still short to the 10**6 random attempts on average (supposing that the codes are entirely random). If you email is part of a list of a thousand, they already had tried more that a million and got access to some of them.