Push authentication, MFA fatigue and number matching
What push authentication is, how MFA fatigue attacks beat it, why number matching stops them, and how it compares with an OTP.
Push authentication replaces “type the code we sent” with “is this you?” on a phone the user already trusts. Done naively, it has a well-known weakness. Done with number matching and a signed challenge, it is one of the safest ways to approve a login or a payment.
How push authentication works
- The user signs in to your app once on their phone. The app makes a key pair; the private key stays in the phone’s secure hardware.
- When someone signs in on the web, your server sends a push to that phone with the device, the place and the time.
- The user confirms with Face ID or a fingerprint. The app signs the request with its key, and your server checks the signature.
The weakness: MFA fatigue
If approval is a single “Approve” button, an attacker with the user’s password can send request after request until the user taps it to make the noise stop. This is MFA fatigue, or push bombing. It was used in the 2022 Uber breach, where a contractor approved one of many spammed requests.
The fix: number matching
The login screen shows a number, say 47. The phone shows three numbers and asks which one is on the screen. Only the person looking at that login screen can answer. Spammed requests cannot be approved by accident.
Microsoft made number matching mandatory for Authenticator push approvals from 8 May 2023 for this reason.
Push approval vs OTP
| SMS OTP | Push approval with number matching | |
|---|---|---|
| Can be read out to a fraud caller | Yes | No, there is no code |
| SIM swap | Catches it | Not affected |
| What it proves | Access to the number | Possession of a phone that signed in, plus a biometric |
| Works for signup | Yes | No, needs a phone already signed in |
| Cost in India | About Rs 0.10 to Rs 0.45 | Rs 0.30 on SignOps, about Rs 4.40 on Twilio Verify Push |
What to require from a push approval system
- Number matching on every request, not optional.
- A biometric or device PIN before the phone signs.
- A signed, single-use challenge with a short expiry, so a copied push approves nothing.
- Context on the phone: device, place, time and, for payments, the amount.
- A fallback when the push is late, such as fetching pending requests when the app opens and an email code.
SignOps Approve has all five, with an SDK for Android, iOS, React Native and Flutter. 100 approvals a day are free.
Sources: BleepingComputer: Microsoft enforces number matching, SC Media: number matching for all Authenticator push notifications.