30

Nowadays, 2FA apps usually require you to insert a number which you are presented with when trying to authenticate. For example, the following screenshot is from Microsoft Authenticator:

Microsoft Authenticator screenshot

This is called number matching, and is in contrast to notification-based 2FA which would simply present the user with a notification stating that a log in attempt was made from XYZ location and asking them to approve.

I have observed that number matching has become more popular than notification-based authentication, but I was unable to find out why. Does inputting the numbers provide extra security? If so, how?

I have also noticed that number matching has somewhat replaced time-based passcode authentication in such apps as well, so I would like to know if it also offers extra security over that.

0

2 Answers 2

48

A Challenge/Response mechanism provides mutual authentication. The request needs to be validated on both sides and it is a more positive overt action.

For MFA notification-based 2FA, all one needs to do is hit the button. I've errantly clicked the "Accept" button while reaching for my phone. If an attacker decides to flood you with login attempts, you will also not know which event the notification is for.

However, with this simple 2-digit code, you can't errantly click, and you have confirmation that the log in you are approving is in fact yours and not someone else's.

2
  • 3
    Any security advantage over time-based passcodes?
    – hb20007
    Feb 2 at 10:07
  • 15
    There's a lot going on under the surface to identify the device, so yes. With pure TOTP, any device with the TOTP seed can generate the code, even unauthorised devices. With "push" type MFA there can be more authentication of the device to ensure that the person providing confirmation is who they say they are.
    – schroeder
    Feb 2 at 10:10
31

This is to prevent multi-factor authentication fatigue attack and other situations where the victim erroneously approve the authentication attempt.

From Advanced Microsoft Authenticator security features are now generally available! - Microsoft Community Hub:

Admins can now prevent accidental approvals in Microsoft Authenticator with number matching ...

If an attacker attempts to log in and you get the push message, you don't know the number and can't accidentally grant access.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .