31–40 of 156 posts
I use Lastpass and I just realized that it prevents phishing since it autocompletes my login info based on the domain.
Which is yet another reason (not that we needed one) why those pages which try to prevent autocomplete of passwords are wrong, wrong, wrong .
Earlier quoted context omitted.
How does it help? Can't the attacker make a query to Google for the user image and display it on the phishing page?
No. There is no email-to-profile-pic mapping endpoint for unauthenticated users, to my knowledge.
2-factor would have prevented this - no ?
Only if you use a U2F hardware token. 2FA using SMS or a smartphone app merely raises the bar for phishing: the attacker can forward the password along to the real service, prompt the user for the 2FA code, forward that along too, and then get a session cookie which they can use to access the account later.
2-factor would have prevented this - no ?
The phisher can just relay your token to establish a login from their end, and still have access to your account. In this article, the attacker created a filter to move all incoming messages to Trash (that doesn't require a token to do), then they deleted the contacts (I don't think that requires a token), and kept an active connection to the Inbox (also doesn't require a token).
Earlier quoted context omitted.
Only if you use a U2F hardware token. 2FA using SMS or a smartphone app merely raises the bar for phishing: the attacker can forward the password along to the real service, prompt the user for the 2FA code, forward that along too, and then get a session cookie which they can use to access the account later.
I've been thinking about buying a YubiKey. Could you elaborate on how U2F protects against MitM and phishing?
Earlier quoted context omitted.
How does it help? Can't the attacker make a query to Google for the user image and display it on the phishing page?
No. There is no email-to-profile-pic mapping endpoint for unauthenticated users, to my knowledge.
They are getting images from somewhere...so...no, this isn't a security feature.
The beginning of the story is missing. PZ clicked on the link in the email because it was "received [...] from a familiar mailing list" . Did PZ trust a mailing list where anyone could post? Or did the attackers spoof the "from" field? The former may have been prevented by employee training, the latter by SPF or similar technologies.
Earlier quoted context omitted.
Here's some more info on that: http://security.stackexchange.com/questions/19155/effectiven...
That's incredible. Not sure if I underestimated hackers ingenuity or underestimated how gullible people are..
I use Lastpass and I just realized that it prevents phishing since it autocompletes my login info based on the domain.
https://labs.detectify.com/2016/07/27/how-i-made-lastpass-gi...