Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We Got Phished

exploratorium.edu

Post reply on HN
Print view View original

71–80 of 156 posts

Re: We Got Phished

#71

Post by x0x0 »

BoysenberryPi wrote: post #3

Many people won't check the url when signing in if everything looks to be on the up and up. This is why I really liked one of the things Yahoo did which was create a sign-in seal. Every time you signed in Yahoo would display a custom image that you set and if that image wasn't there then something was probably wrong.

But phishers can praxy the 3rd party site to you. And this isn't hard to do. It might help w/ your relatives, but for anything even mildly targeted you can certainly rent a couple t2.nano to pull this off...

Re: We Got Phished

#72

Post by _delirium »

ryanobjc wrote: post #42

2 factor authentication is key here. The ubikey is a gold standard for business - no one should do serious business without it! For everyone else, I think the new 2fa Google App approach is better. When you go to login, your Google App pushes a notification to your phone and you have to click on it. This raises the bar to doing a simultaneous login, which isn't impossible, but even if it weeds out a large number of a…

I don't think I'd call what Google does 2-factor authentication. Unless I'm missing some option to change this behavior, it's still 1-factor, but what changes when you enable it is which factor is the fundamentally required one. With it disabled, you have one factor, the password; anyone who gets it can log on. With it enabled, the password is no longer the single factor, but it is also no longer a required factor at all, because the password-reset mechanism goes through the same phone number used for the 2fa SMS pushes. So now the phone (or more specifically, ability to receive SMSs to the saved number) becomes the single factor. To be actual 2fa, someone in possession of only one of the two factors shouldn't be able to override the other factor.

There are obvious reasons Google does it this way, and it is probably a net increase in security, because a phone as a single factor is less often compromised than a password as a single factor. But I don't like calling that particular arrangement 2fa.

Re: We Got Phished

#73

Post by x0x0 »

I recently saw a link, that I unfortunately can't find, where someone senior affiliated with Defcon or black hat nearly got phished. He was rushing packing in the midst of a flurry of amazon shipments to travel to some conference and got a very well timed phishing email asking him to confirm some sort of shipment details for amazon. He fortunately noticed it was the wrong product, but I seem to remember had started typing his info already.

If someone like that can get nearly fooled, there's little hope for the rest of us or our families.

It's time to give up preventing phishing and start working on amelioration.

ps -- if anybody knows the story I'm talking about, I'd love the link.

Re: We Got Phished

#74

Post by pbreit »

ryanobjc wrote: post #42

2 factor authentication is key here. The ubikey is a gold standard for business - no one should do serious business without it! For everyone else, I think the new 2fa Google App approach is better. When you go to login, your Google App pushes a notification to your phone and you have to click on it. This raises the bar to doing a simultaneous login, which isn't impossible, but even if it weeds out a large number of a…

Shouldn't Google easily be able to mitigate a login from Africa (or just a different country or even a never-before-used IP)?

Re: We Got Phished

#75

Post by x0x0 »

_delirium wrote: post #72
ryanobjc wrote: post #42

2 factor authentication is key here. The ubikey is a gold standard for business - no one should do serious business without it! For everyone else, I think the new 2fa Google App approach is better. When you go to login, your Google App pushes a notification to your phone and you have to click on it. This raises the bar to doing a simultaneous login, which isn't impossible, but even if it weeds out a large number of a…

I don't think I'd call what Google does 2-factor authentication. Unless I'm missing some option to change this behavior, it's still 1-factor, but what changes when you enable it is which factor is the fundamentally required one. With it disabled, you have one factor, the password; anyone who gets it can log on. With it enabled, the password is no longer the single factor, but it is also no longer a required factor at…

Also, you can steal someone's phone account in about a hot minute. Watch:

https://youtu.be/bjYhmX_OUQQ?t=98

This phishing test company has one of their employees steal a reporter's cell phone and it's amazing. She basically plays a crying baby on youtube and just grabs the account without knowing anything...

(posted by @nbadg https://news.ycombinator.com/item?id=12598989 )

Re: We Got Phished

#76

Post by jensvdh »

pbreit wrote: post #74
ryanobjc wrote: post #42

2 factor authentication is key here. The ubikey is a gold standard for business - no one should do serious business without it! For everyone else, I think the new 2fa Google App approach is better. When you go to login, your Google App pushes a notification to your phone and you have to click on it. This raises the bar to doing a simultaneous login, which isn't impossible, but even if it weeds out a large number of a…

Shouldn't Google easily be able to mitigate a login from Africa (or just a different country or even a never-before-used IP)?

It looks like they had control over some servers in the US. Perhaps they logged in from those remote servers?

Re: We Got Phished

#77

Post by ghurtado »

BoysenberryPi wrote: post #3

Many people won't check the url when signing in if everything looks to be on the up and up. This is why I really liked one of the things Yahoo did which was create a sign-in seal. Every time you signed in Yahoo would display a custom image that you set and if that image wasn't there then something was probably wrong.

Yup. Verizon Wireless does this as well.

Re: We Got Phished

#78

Post by ryanobjc »

shelbyfinally wrote: post #50
ryanobjc wrote: post #42

2 factor authentication is key here. The ubikey is a gold standard for business - no one should do serious business without it! For everyone else, I think the new 2fa Google App approach is better. When you go to login, your Google App pushes a notification to your phone and you have to click on it. This raises the bar to doing a simultaneous login, which isn't impossible, but even if it weeds out a large number of a…

It's Yubikey. Google Authenticator doesn't do any kind of push notification when you log in. Each endpoint uses a shared secret (the server and the mobile app share that secret beforehand) to generate a time-limited code.

Actually I was talking about another method:

http://lifehacker.com/google-prompt-lets-you-use-two-factor-...

Essentially its like 2 factor auth, except you arent conveying codes from your phone to the computer.

This is a nice feature because it is a lot more user friendly than normal 2fa, it's free if you have a smart phone and well, it works.

Re: We Got Phished

#79

Post by ryanobjc »

pbreit wrote: post #74
ryanobjc wrote: post #42

2 factor authentication is key here. The ubikey is a gold standard for business - no one should do serious business without it! For everyone else, I think the new 2fa Google App approach is better. When you go to login, your Google App pushes a notification to your phone and you have to click on it. This raises the bar to doing a simultaneous login, which isn't impossible, but even if it weeds out a large number of a…

Shouldn't Google easily be able to mitigate a login from Africa (or just a different country or even a never-before-used IP)?

they can, and they do. as TFA noted, there was a bounce in the US.

Re: We Got Phished

#80

Post by emodendroket »

minimaxir wrote: post #52
emodendroket wrote: post #43

Earlier quoted context omitted.

But it's also the default behavior if you sign on from a computer Google doesn't recognize, so it's not really strange to see the grey icon instead.

When you first go to a Google sign-on, it asks for your email. Once you input your email, it then shows you the profile picture corresponding to the account, and asks you to input the password. If the account has no profile picture, the icon is blue instead of gray. (Tested in Incognito mode)

That's not correct. If you sign on from an unrecognized computer, it doesn't show your photo. Using incognito mode doesn't make you "unrecognized;" you need to have a different IP.
Post reply on HN