161–170 of 323 posts
Random thought I’ve been having as we keep bringing this topic up these past few weeks… How interesting or uninteresting would bi-modal 2FA be ? That is: you receive a code by text and you enter the code by email… I haven’t spent any time to work out whether this significantly changes the attack surface but… At first glance it does seem like you would need to own two different account types… … So I guess a first ques…
Earlier quoted context omitted.
Why isn't there any market fulfillment for "safe, non-intrusive ads", on the part of a vendor? Is it because it's not possible, or not worth the overhead either because of cost or no effect on consumer behavior/blocking? This seems like it ought to be low-hanging fruit. I would have less aversion to clicking on ads if I did not default to it being a security risk.
They are rare but do exist, see ethicalads and Modrinth’s ad program
I am not ideologically opposed to advertisements but I do believe the only safe ads are first party hosted coming from the same domain.
And unfortunately almost every bank forces me to use them, because their apps refuse to run on my rooted phone. Nice security win there!
That is a security win. On a rooted phone, you've made it possible for other apps to spy on and steal your banking information. Bank apps not running on phones where security has been compromised seems entirely reasonable.
I instead have to use my desktop web browser, and desktop operating systems have a far worse security model than Android. No special permissions are generally needed to capture the screen, capture/inject keystrokes, or open .mozilla/whatever/cookies.sqlite
So my phone is still the significantly more secure environment. The fact that I have the ability to grant root does not make it "compromised"
I think we should just ban companies from implementing SMS 2FA. https://lorendb.dev/posts/lets-ban-sms-2fa/
This causes far more harm than good - even this article admits SMS 2FA is better than nothing. For several 99.99999% of use cases, it is fine, SIM swapping is an extremely targeted attack. If you are the type of person that can be targeted by an attack like that, don't use SMS for anything important. Simple.
Earlier quoted context omitted.
Turns out ads aren't just annoying little acts of psychological terrorism that eat up a lot of bandwidth and computing power, they are also the #1 vector for spreading scams and malware on the web. In other words: If you're trying to improve your security posture, installing an ad-blocker is one of the best things you can do. If you have less tech-savvy friends and relatives, I would strongly recommend setting up uBl…
Why isn't there any market fulfillment for "safe, non-intrusive ads", on the part of a vendor? Is it because it's not possible, or not worth the overhead either because of cost or no effect on consumer behavior/blocking? This seems like it ought to be low-hanging fruit. I would have less aversion to clicking on ads if I did not default to it being a security risk.
A family friend of ours recently fell victim to a phishing attack perpetrated by an attacker who paid for Google Ads for a search term like "BANKNAME login". The site was an immaculate knock off, with a replay attack in the background. She entered her 2fa code from the app on her phone but the interface rejected the code and asked her for another one. In the background, this 2nd code was actually to authorise the add…
Another lesson here is to bookmark/ memorize the url of your bank, and don’t trust search engines to take you to your bank
In my experience with Bank of America and US Bank they bounce you around to several totally different top level domains as you navigate through the web-based banking.
These are third-party service providers that the banks contract for various pieces of their online infra… And it is a complete mess in terms of conditioning consumers to be phished.
Google has recently started enforcing their own “click yes on already authorize mobile device” 2FA, which is very frustrating.
I have hardware 2FA keys that I keep in a safe. I deliberately do not keep them on me, and using them to re-auth is mentally an “event”.
This is not the case with my cell phone, which my kids play with, gets left on my dresser while the cleaners work, etc.
Really pushing me to run my own services again, but that obviously comes with its own challenges.
Earlier quoted context omitted.
That is a security win. On a rooted phone, you've made it possible for other apps to spy on and steal your banking information. Bank apps not running on phones where security has been compromised seems entirely reasonable.
Only if I grant them root, which I'd only do to a very small number of open source apps I instead have to use my desktop web browser, and desktop operating systems have a far worse security model than Android. No special permissions are generally needed to capture the screen, capture/inject keystrokes, or open .mozilla/whatever/cookies.sqlite So my phone is still the significantly more secure environment. The fact th…
But that's exactly the point. The bank doesn't know what you've granted root. It doesn't know if you're a security researcher, or somebody installing pirated apps with spyware.
The bank can't enforce that on desktop web browsers, but at least it can on mobile.
A family friend of ours recently fell victim to a phishing attack perpetrated by an attacker who paid for Google Ads for a search term like "BANKNAME login". The site was an immaculate knock off, with a replay attack in the background. She entered her 2fa code from the app on her phone but the interface rejected the code and asked her for another one. In the background, this 2nd code was actually to authorise the add…
Another lesson here is to bookmark/ memorize the url of your bank, and don’t trust search engines to take you to your bank
Sites like Digital Ocean try to load dozens of third-party trackers for a single page. Their supposedly secure payment processing includes cross-site violations that are blocked by modern browsers.
When their credit card management pages fail to work with reasonable browser defaults or sane browser add-ons they immediately advise their users to strip out all security protections. You are supposed to just trust content coming from seemingly unrelated domains including multiple processors you may or may not have ever heard of. Paypal? Ok, plausible. Stripe? I guess, but both? Pendo? Sentry? Optimizely? Hexagon? Google Ads? Google Analytics? Six other different Paypal domains? Eight other Stripe domains? Multiple Typekit domains? TagManager? Spuare? The list keeps going.
Plenty of reasonable protections cause alarm bells left and right. The answer? Disable those protections. Train users to think they are the problem.
A family friend of ours recently fell victim to a phishing attack perpetrated by an attacker who paid for Google Ads for a search term like "BANKNAME login". The site was an immaculate knock off, with a replay attack in the background. She entered her 2fa code from the app on her phone but the interface rejected the code and asked her for another one. In the background, this 2nd code was actually to authorise the add…