{
  "slug": "mfa-fatigue-approve-nothing",
  "title": "Approve is a button, not a sentence.",
  "summary": "Number matching largely killed the naive MFA fatigue attack. The design flaw underneath it is untouched: the approval never says what is being approved.",
  "lede": "The industry mostly fixed push bombing, and number matching deserves the credit. What it did not fix is the reason the attack worked in the first place, which is that an approval prompt has never been required to say what it is approving.",
  "date": "2026-09-23",
  "reading_time": "16 min read",
  "category": "Security",
  "tags": ["MFA fatigue", "push bombing", "number matching", "approval design", "phishing resistant MFA", "authorization"],
  "image": "https://cdn.twc.sh/images/igcache/MFA%20Fatigue%20Push%20Bombing/1200_630/blog.jpg",
  "url": "/blog/mfa-fatigue-approve-nothing.html",
  "wordcount": 3348,
  "related": ["device-code-phishing", "approval-theater", "sms-otp-is-not-authorization"],
  "schema": "Article"
}