Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We Got Phished

exploratorium.edu

Post reply on HN
Print view View original

51–60 of 156 posts

Re: We Got Phished

#51

Post by AdmiralAsshat »

BoysenberryPi wrote: post #3

Many people won't check the url when signing in if everything looks to be on the up and up. This is why I really liked one of the things Yahoo did which was create a sign-in seal. Every time you signed in Yahoo would display a custom image that you set and if that image wasn't there then something was probably wrong.

I've run into several websites that use the "security image", and to be honest most of them I don't actually remember what they are until I see them. I can't choose the image myself, so one of them is something banal like a toaster. If I see the toaster, okay, I'm good. But am I 100% certain that if I see a banana instead that I'll say "Something is amiss here!"? I really don't know.

On the other hand, if I could upload my own security image for each site, I guarantee I would remember it, because I'd probably use something I drew myself.

Re: We Got Phished

#52

Post by minimaxir »

emodendroket wrote: post #43
minimaxir wrote: post #2

It's worth nothing the new user-image-before-password-input for Google is an anti-phishing feature. Of course, most people won't think that deeply when prompted with a password request and a similar UI.

But it's also the default behavior if you sign on from a computer Google doesn't recognize, so it's not really strange to see the grey icon instead.

When you first go to a Google sign-on, it asks for your email. Once you input your email, it then shows you the profile picture corresponding to the account, and asks you to input the password. If the account has no profile picture, the icon is blue instead of gray. (Tested in Incognito mode)

Re: We Got Phished

#53

Post by minimaxir »

agwa wrote: post #32
minimaxir wrote: post #27

Earlier quoted context omitted.

No. There is no email-to-profile-pic mapping endpoint for unauthenticated users, to my knowledge.

Then how does the image consistently display before the password has been provided? No matter what the answer is, I don't see how it could be an anti-phishing feature.

Google naturally has their own private APIs which will only show the profile image for legitimate logins.

Re: We Got Phished

#54

Post by probably_wrong »

ryanobjc wrote: post #42

2 factor authentication is key here. The ubikey is a gold standard for business - no one should do serious business without it! For everyone else, I think the new 2fa Google App approach is better. When you go to login, your Google App pushes a notification to your phone and you have to click on it. This raises the bar to doing a simultaneous login, which isn't impossible, but even if it weeds out a large number of a…

I'm waiting for the day in which I can sign up for 2FA without giving my phone number. At this point, I believe they are holding it on purpose, as my phone number is a much more reliable unique identifier than my username and/or cookies.

(Yes, you can use the Google authenticator, but no, you can't do it if you haven't given your phone number first)

Edit: by "they" I mean GMail - other sites work just fine.

Re: We Got Phished

#55

Post by mathgenius »

Ok, this article is great and I'd like to share it with all my friends. BUT, it says nothing about how to mitigate against phishing and so ... would leave the average internet user just vaguely paranoid, which is not helpful.

I'd like to contact the author and get him to append something about "check the url". But I guess they are not advertising their email addresses anymore :-)

Re: We Got Phished

#56

Post by kbar13 »

shelbyfinally wrote: post #50
ryanobjc wrote: post #42

2 factor authentication is key here. The ubikey is a gold standard for business - no one should do serious business without it! For everyone else, I think the new 2fa Google App approach is better. When you go to login, your Google App pushes a notification to your phone and you have to click on it. This raises the bar to doing a simultaneous login, which isn't impossible, but even if it weeds out a large number of a…

It's Yubikey. Google Authenticator doesn't do any kind of push notification when you log in. Each endpoint uses a shared secret (the server and the mobile app share that secret beforehand) to generate a time-limited code.

op isn't talking about totp, it's the push notification you get when you log in on a new device (the "review your recent login" notification)

Re: We Got Phished

#57

Post by mamurphy »

makmanalp wrote: post #8
BoysenberryPi wrote: post #3

Many people won't check the url when signing in if everything looks to be on the up and up. This is why I really liked one of the things Yahoo did which was create a sign-in seal. Every time you signed in Yahoo would display a custom image that you set and if that image wasn't there then something was probably wrong.

Here's some more info on that: http://security.stackexchange.com/questions/19155/effectiven...

As a note, I think many banks have now removed security images. My bank used to have them, and now they don't.

Re: We Got Phished

#58

Post by agwa »

k_sh wrote: post #45
agwa wrote: post #36

Earlier quoted context omitted.

U2F knows what domain you're using it with, and won't send an authentication token for google.com to phisher.com.

A password manager will do the same thing for you. (I'm not arguing that PMs are >= to hardware 2FA, but they both will keep this exact thing from happening)

Indeed it will. In fact, I'm not convinced U2F adds any meaningful security over a good password manager.

Re: We Got Phished

#59

Post by sopooneo »

BoysenberryPi wrote: post #3

Many people won't check the url when signing in if everything looks to be on the up and up. This is why I really liked one of the things Yahoo did which was create a sign-in seal. Every time you signed in Yahoo would display a custom image that you set and if that image wasn't there then something was probably wrong.

Couldn't the hacker just pass on the username that I assume is being used to select the photo on the real site, and then put that image in place on their fake login site?

Re: We Got Phished

#60

Post by justinpombrio »

theandrewbailey wrote: post #41
justinpombrio wrote: post #12

Earlier quoted context omitted.

My bank (ING Direct) had that. And then they were bought by Capital One, who removed it.

Did you refuse to sign in without it?

That would have been bad for me but not for the bank. I called them, got a non-answer, and was too apathetic to push harder.
Post reply on HN