This is why you have to give the enduser a way of authenticating the authenticator. The well-designed Adobe Account Access app often presents the user with a random number that they have to tap on in the authenticator app. The authenticator app presents that number along with some other random numbers, asking the user to pick the correct one.
The random number list is not always presented. I presume that Adobe skips presenting the number challenge if the user is logging in with a relatively fresh cookie or from a recently associated device. But I guarantee that login attempts from a new device would prompt this more strict authentication step.
Microsoft now appears to do this (thank you, Traubenfuchs).
The random number list is not always presented. I presume that Adobe skips presenting the number challenge if the user is logging in with a relatively fresh cookie or from a recently associated device. But I guarantee that login attempts from a new device would prompt this more strict authentication step.
Microsoft now appears to do this (thank you, Traubenfuchs).