101–110 of 156 posts
2 factor authentication is key here. The ubikey is a gold standard for business - no one should do serious business without it! For everyone else, I think the new 2fa Google App approach is better. When you go to login, your Google App pushes a notification to your phone and you have to click on it. This raises the bar to doing a simultaneous login, which isn't impossible, but even if it weeds out a large number of a…
2 factor authentication is key here. The ubikey is a gold standard for business - no one should do serious business without it! For everyone else, I think the new 2fa Google App approach is better. When you go to login, your Google App pushes a notification to your phone and you have to click on it. This raises the bar to doing a simultaneous login, which isn't impossible, but even if it weeds out a large number of a…
Does 2 factor prevent phishing though? If I was going to do a Google Phishing page - I would take the username + password that the user supplied into MY fake page, and POST/CURL that to the Google login. If Google returns asking for a 2factor to MY fake, I would display the 2 factor prompt to the user, and get them to type the 2-factor into my page, which I would pass back to Google. Basically you can use a phishing…
Earlier quoted context omitted.
To use google authenticator you do not need to give out your number. Most sites will have a qr code you can scan with your phone and the google authenticator app uses that to generate 2fa codes that are valid within a certain time frame.
I just checked. The first screen I got says "Step 1/3: we'll either call you or send you an SMS. Please give us your phone number". You cannot skip this step on GMail, or at least I couldn't find how. I know you can use the app afterwards , but not before . Other sites just give me the code, as you say. But not GMail.
2 factor authentication is key here. The ubikey is a gold standard for business - no one should do serious business without it! For everyone else, I think the new 2fa Google App approach is better. When you go to login, your Google App pushes a notification to your phone and you have to click on it. This raises the bar to doing a simultaneous login, which isn't impossible, but even if it weeds out a large number of a…
Does 2 factor prevent phishing though? If I was going to do a Google Phishing page - I would take the username + password that the user supplied into MY fake page, and POST/CURL that to the Google login. If Google returns asking for a 2factor to MY fake, I would display the 2 factor prompt to the user, and get them to type the 2-factor into my page, which I would pass back to Google. Basically you can use a phishing…
You're right, though, TOTP is not enough.
Many people won't check the url when signing in if everything looks to be on the up and up. This is why I really liked one of the things Yahoo did which was create a sign-in seal. Every time you signed in Yahoo would display a custom image that you set and if that image wasn't there then something was probably wrong.
I've run into several websites that use the "security image", and to be honest most of them I don't actually remember what they are until I see them. I can't choose the image myself, so one of them is something banal like a toaster. If I see the toaster, okay, I'm good. But am I 100% certain that if I see a banana instead that I'll say "Something is amiss here!"? I really don't know. On the other hand, if I could upl…
If I don't see a big goofy dog saying "Who's a good boy? [my dog's name] is a good boy!", I know I'm not on the right website.
Google provides a Chrome extension that alerts you (and an administrator) if you accidentally enter your Google password on a site that isn't accounts.google.com: https://github.com/google/password-alert
Earlier quoted context omitted.
A password manager will do the same thing for you. (I'm not arguing that PMs are >= to hardware 2FA, but they both will keep this exact thing from happening)
Indeed it will. In fact, I'm not convinced U2F adds any meaningful security over a good password manager.
Bytes in a password manager are hard to steal, but if you do steal them, the legitimate owner won't necessarily ever know.
Earlier quoted context omitted.
I just checked. The first screen I got says "Step 1/3: we'll either call you or send you an SMS. Please give us your phone number". You cannot skip this step on GMail, or at least I couldn't find how. I know you can use the app afterwards , but not before . Other sites just give me the code, as you say. But not GMail.
You could create a Google Voice account with a free number and link to that. Set it up so calls/sms/etc go nowhere but can be changed if you need to restore your Gmail account later with that number.
You should get two though. Register both. Put one somewhere very safe, like a safe-deposit box.
Earlier quoted context omitted.
To use google authenticator you do not need to give out your number. Most sites will have a qr code you can scan with your phone and the google authenticator app uses that to generate 2fa codes that are valid within a certain time frame.
I just checked. The first screen I got says "Step 1/3: we'll either call you or send you an SMS. Please give us your phone number". You cannot skip this step on GMail, or at least I couldn't find how. I know you can use the app afterwards , but not before . Other sites just give me the code, as you say. But not GMail.