Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We Got Phished

exploratorium.edu

Post reply on HN
Print view View original

111–120 of 156 posts

Re: We Got Phished

#111

Post by acdha »

laurencei wrote: post #97
ryanobjc wrote: post #42

2 factor authentication is key here. The ubikey is a gold standard for business - no one should do serious business without it! For everyone else, I think the new 2fa Google App approach is better. When you go to login, your Google App pushes a notification to your phone and you have to click on it. This raises the bar to doing a simultaneous login, which isn't impossible, but even if it weeds out a large number of a…

Does 2 factor prevent phishing though? If I was going to do a Google Phishing page - I would take the username + password that the user supplied into MY fake page, and POST/CURL that to the Google login. If Google returns asking for a 2factor to MY fake, I would display the 2 factor prompt to the user, and get them to type the 2-factor into my page, which I would pass back to Google. Basically you can use a phishing…

This is where the type of MFA matters a lot: with a TOTP code, that phishing attack will be successful.

With U2F, however, a per-host keypair is generated during the setup process and the public key is given to the remote server. Critically, the hostname as seen by your browser is part of the key identifier: see http://security.stackexchange.com/a/71704/311

That means that if in the future even if someone convinces you to visit their phishing site and activate the token, the login attempt will still fail because the hostname as seen by the browser won't match a key on the token.

Re: We Got Phished

#112

Post by dublinben »

_delirium wrote: post #72
ryanobjc wrote: post #42

2 factor authentication is key here. The ubikey is a gold standard for business - no one should do serious business without it! For everyone else, I think the new 2fa Google App approach is better. When you go to login, your Google App pushes a notification to your phone and you have to click on it. This raises the bar to doing a simultaneous login, which isn't impossible, but even if it weeds out a large number of a…

I don't think I'd call what Google does 2-factor authentication. Unless I'm missing some option to change this behavior, it's still 1-factor, but what changes when you enable it is which factor is the fundamentally required one. With it disabled, you have one factor, the password; anyone who gets it can log on. With it enabled, the password is no longer the single factor, but it is also no longer a required factor at…

2FA using a phone number isn't really 2FA, as you've said. There's a reason this method has been deprecated by the NIST and other folks making recommendations about this.

Used correctly, their TOTP app is a real second factor, because it only lives on a single device that you have.

Re: We Got Phished

#113

Post by startling »

Raphmedia wrote: post #105
AdmiralAsshat wrote: post #51

Earlier quoted context omitted.

I've run into several websites that use the "security image", and to be honest most of them I don't actually remember what they are until I see them. I can't choose the image myself, so one of them is something banal like a toaster. If I see the toaster, okay, I'm good. But am I 100% certain that if I see a banana instead that I'll say "Something is amiss here!"? I really don't know. On the other hand, if I could upl…

My bank has security image + security user written sentence. If I don't see a big goofy dog saying "Who's a good boy? [my dog's name] is a good boy!", I know I'm not on the right website.

So, what's stopping the wrong site from making those requests to your bank and proxying the image?

Re: We Got Phished

#114

Post by acdha »

k_sh wrote: post #45
agwa wrote: post #36

Earlier quoted context omitted.

U2F knows what domain you're using it with, and won't send an authentication token for google.com to phisher.com.

A password manager will do the same thing for you. (I'm not arguing that PMs are >= to hardware 2FA, but they both will keep this exact thing from happening)

One key difference which made me appreciate the thought which went into U2F: people using password managers can still copy and paste the real password into the form, which they're somewhat trained to do by all of the large websites which don't have / don't have working single sign on.

With U2F that failure mode is impossible since you cannot get the private key to shoot yourself in the foot with, even if the phisher successfully convinces you to try.

Re: We Got Phished

#115

Post by m4dc4pXXX »

ryanobjc wrote: post #42

2 factor authentication is key here. The ubikey is a gold standard for business - no one should do serious business without it! For everyone else, I think the new 2fa Google App approach is better. When you go to login, your Google App pushes a notification to your phone and you have to click on it. This raises the bar to doing a simultaneous login, which isn't impossible, but even if it weeds out a large number of a…

https://tozny.com/ sells a service that enables this for any app, not just Google.

I have a Yubikey and I find it too obnoxious for day-to-day use. I'd rather use an authenticator app (such as Google's or LastPass').

For TOTP on non-Google sites, I find LastPass better than Google's Authenticator. First, LastPass locks the app with a PIN. Second, it can work with the browser extension to fill out those 6-digit codes for you.

Re: We Got Phished

#116

Post by DvdGiessen »

botto wrote: post #44

This is why SQRL just needs to be completed and everyone should move to it.

I never heard of SQRL specifically before, so I just spent some time researching it. From what I can find, it has some significant flaws[0], and it doesn't seem these can be addressed without defeating the few advantages this SQRL approuch has.

[0]: http://security.blogoverflow.com/2013/10/debunking-sqrl/

Re: We Got Phished

#117

Post by kbar13 »

askmike wrote: post #63
kbar13 wrote: post #56

Earlier quoted context omitted.

op isn't talking about totp, it's the push notification you get when you log in on a new device (the "review your recent login" notification)

op is talking about "Google prompt". See here: http://arstechnica.com/gadgets/2016/06/googles-new-two-facto...

oh nice, that's even better

Re: We Got Phished

#118

Post by [deleted] »

dublinben wrote: post #112
_delirium wrote: post #72

Earlier quoted context omitted.

I don't think I'd call what Google does 2-factor authentication. Unless I'm missing some option to change this behavior, it's still 1-factor, but what changes when you enable it is which factor is the fundamentally required one. With it disabled, you have one factor, the password; anyone who gets it can log on. With it enabled, the password is no longer the single factor, but it is also no longer a required factor at…

2FA using a phone number isn't really 2FA, as you've said. There's a reason this method has been deprecated by the NIST and other folks making recommendations about this. Used correctly, their TOTP app is a real second factor, because it only lives on a single device that you have .

[deleted]

Re: We Got Phished

#119

Post by mackmgg »

ryanobjc wrote: post #85
callesgg wrote: post #84

At my company we get these things 2-3 times a year. Surprisingly many people understand that there is something fishy. But "Surprisingly many" is not enough. 2FA is not enough here a user that does not have the required knowledge to see what is phishing and what is not will most likely enter the 2FA key giving the bad guys the auth tokens anyway.

That's why yubikey is important - it does it's own verification of the site. You can't MITM it.

Newer Yubikeys support U2F, which I haven't seen any way to phish yet, but the Yubikey protocol is still possible to phish.

To do this, the fake login page says that the token was incorrect the first time (which would possibly alert some people, but certainly not everyone), and then when the user submits a second token, the phishing site sends the first one to the real site. They now have an unused token which can be used up until the user logs into another website (thus invalidating the 'unused' one).

Re: We Got Phished

#120

Post by Tortoise »

startling wrote: post #113
Raphmedia wrote: post #105

Earlier quoted context omitted.

My bank has security image + security user written sentence. If I don't see a big goofy dog saying "Who's a good boy? [my dog's name] is a good boy!", I know I'm not on the right website.

So, what's stopping the wrong site from making those requests to your bank and proxying the image?

The bank sets a cookie on your machine and only displays the image if you have the cookie. You won't get the image on a machine you've never used to log in before.
Post reply on HN