TechnoTalk: Time to Tech

[benji]

https://answers.microsoft.com/en-us/windows/forum/all/constant-receipt-of-your-single-use-code/970dc4fd-e68d-4f8e-9fc0-00d65702d86b

My concern is that, since this is just a 7 digit number, on scale (i.e. after many attempts across many email addresses) someone could obtain unauthorised access to an account by simply requesting a large number of single use codes every day across many accounts.

I am aware that the risk to me personally is quite low, however the risk to someone is very high. With a list of just 170,000 emails, an average of one person would be comprised each year with 1 attempt per week. I'm unsure the restrictions of how frequently attempts can be made, but obviously the number comprised would rise dramatically if attempts can be made more frequently or the list is made bigger.

I can only guess that I am on such a list, and presumably the actor is making attempts relatively infrequently to remain under the radar from automatic detection. Essentially the way the system is set up, there is a bypass password that is always just a 7 digit password (an extraordinarily weak password from password standards). This seems like a security hole unless I'm missing something?

This physically hurts.