61–70 of 156 posts
I use Lastpass and I just realized that it prevents phishing since it autocompletes my login info based on the domain.
2 factor authentication is key here. The ubikey is a gold standard for business - no one should do serious business without it! For everyone else, I think the new 2fa Google App approach is better. When you go to login, your Google App pushes a notification to your phone and you have to click on it. This raises the bar to doing a simultaneous login, which isn't impossible, but even if it weeds out a large number of a…
I'm waiting for the day in which I can sign up for 2FA without giving my phone number. At this point, I believe they are holding it on purpose, as my phone number is a much more reliable unique identifier than my username and/or cookies. (Yes, you can use the Google authenticator, but no, you can't do it if you haven't given your phone number first) Edit: by "they" I mean GMail - other sites work just fine.
Earlier quoted context omitted.
It's Yubikey. Google Authenticator doesn't do any kind of push notification when you log in. Each endpoint uses a shared secret (the server and the mobile app share that secret beforehand) to generate a time-limited code.
op isn't talking about totp, it's the push notification you get when you log in on a new device (the "review your recent login" notification)
See here: http://arstechnica.com/gadgets/2016/06/googles-new-two-facto...
Earlier quoted context omitted.
You can use Google's AMP that is hosted on their domain, to host a redirect, effectively using their domain to host the phishing attempt. Check the screenshots on http://motherboard.vice.com/read/how-hackers-broke-into-john...
Don't those screenshots just show domains crafted deceptively to look like Google domains? I don't see any legitimate Google ones. > “We are approaching the point in this case where there are only two reasons for why people say there’s no good evidence,” Rid told me. “The first reason is because they don’t understand the evidence—because the don’t have the necessary technical knowledge. The second reason is they don’…
Earlier quoted context omitted.
Don't those screenshots just show domains crafted deceptively to look like Google domains? I don't see any legitimate Google ones. > “We are approaching the point in this case where there are only two reasons for why people say there’s no good evidence,” Rid told me. “The first reason is because they don’t understand the evidence—because the don’t have the necessary technical knowledge. The second reason is they don’…
Notice in one of the last screenshots, the link actually points to a real Google.com domain, but in the /amp/ destination, under which a tiny(cc) link was hidden and therefore fetched the content that "seemed like" it came from Google when Google merely acted as a CDN.
Earlier quoted context omitted.
I'm waiting for the day in which I can sign up for 2FA without giving my phone number. At this point, I believe they are holding it on purpose, as my phone number is a much more reliable unique identifier than my username and/or cookies. (Yes, you can use the Google authenticator, but no, you can't do it if you haven't given your phone number first) Edit: by "they" I mean GMail - other sites work just fine.
To use google authenticator you do not need to give out your number. Most sites will have a qr code you can scan with your phone and the google authenticator app uses that to generate 2fa codes that are valid within a certain time frame.
You cannot skip this step on GMail, or at least I couldn't find how. I know you can use the app afterwards, but not before.
Other sites just give me the code, as you say. But not GMail.
2 factor authentication is key here. The ubikey is a gold standard for business - no one should do serious business without it! For everyone else, I think the new 2fa Google App approach is better. When you go to login, your Google App pushes a notification to your phone and you have to click on it. This raises the bar to doing a simultaneous login, which isn't impossible, but even if it weeds out a large number of a…
Yubikey devices are U2F compatible. (And in my opinion one of the best devices out there, thanks to PGP/SSH smartcard support.) But there are also cheaper versions on Amazon that work just as well if you're on a budget.
I personally know some people who work for Exploratorium. Not the sharpest tools in the shed.. ;)
2 factor authentication is key here. The ubikey is a gold standard for business - no one should do serious business without it! For everyone else, I think the new 2fa Google App approach is better. When you go to login, your Google App pushes a notification to your phone and you have to click on it. This raises the bar to doing a simultaneous login, which isn't impossible, but even if it weeds out a large number of a…
What if the password input would only be shown after the user typed in their username, pressed submit and confirmed that they were trying to log in using their mobile device?
* Input username
* Press submit
* Interact with mobile device for 2FA
* Input password
* Press submit