Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We Got Phished

exploratorium.edu

Post reply on HN
Print view View original

11–20 of 156 posts

Re: We Got Phished

#12

Post by justinpombrio »

BoysenberryPi wrote: post #3

Many people won't check the url when signing in if everything looks to be on the up and up. This is why I really liked one of the things Yahoo did which was create a sign-in seal. Every time you signed in Yahoo would display a custom image that you set and if that image wasn't there then something was probably wrong.

My bank (ING Direct) had that. And then they were bought by Capital One, who removed it.

Re: We Got Phished

#14

Post by BoysenberryPi »

makmanalp wrote: post #8
BoysenberryPi wrote: post #3

Many people won't check the url when signing in if everything looks to be on the up and up. This is why I really liked one of the things Yahoo did which was create a sign-in seal. Every time you signed in Yahoo would display a custom image that you set and if that image wasn't there then something was probably wrong.

Here's some more info on that: http://security.stackexchange.com/questions/19155/effectiven...

That's incredible. Not sure if I underestimated hackers ingenuity or underestimated how gullible people are..

Re: We Got Phished

#16

Post by agwa »

misiti3780 wrote: post #4

2-factor would have prevented this - no ?

Only if you use a U2F hardware token. 2FA using SMS or a smartphone app merely raises the bar for phishing: the attacker can forward the password along to the real service, prompt the user for the 2FA code, forward that along too, and then get a session cookie which they can use to access the account later.

Re: We Got Phished

#17

Post by agwa »

minimaxir wrote: post #2

It's worth nothing the new user-image-before-password-input for Google is an anti-phishing feature. Of course, most people won't think that deeply when prompted with a password request and a similar UI.

How does it help? Can't the attacker make a query to Google for the user image and display it on the phishing page?

Re: We Got Phished

#18

Post by function_seven »

misiti3780 wrote: post #4

2-factor would have prevented this - no ?

The phisher can just relay your token to establish a login from their end, and still have access to your account. In this article, the attacker created a filter to move all incoming messages to Trash (that doesn't require a token to do), then they deleted the contacts (I don't think that requires a token), and kept an active connection to the Inbox (also doesn't require a token).

Re: We Got Phished

#19

Post by nmc »

The beginning of the story is missing. PZ clicked on the link in the email because it was "received [...] from a familiar mailing list".

Did PZ trust a mailing list where anyone could post? Or did the attackers spoof the "from" field? The former may have been prevented by employee training, the latter by SPF or similar technologies.

Post reply on HN