While you're add it, verify that your password has not been hacked by entering it here: hxxp://evil.example.com/password-checker
Be warned, there's a nasty Google 2 factor auth attack going around
21–30 of 61 posts
Re: Be warned, there's a nasty Google 2 factor auth attack going around
#22I guess I'm going to go set all my security question answers to random 64-byte strings that are base-64 encoded.
Don't forget to apply a ROT-13 encoding afterwards, that should make it super secure.
Re: Be warned, there's a nasty Google 2 factor auth attack going around
#23I guess I'm going to go set all my security question answers to random 64-byte strings that are base-64 encoded.
Don't forget to apply a ROT-13 encoding afterwards, that should make it super secure.
I'm doubly secure with ROT-13 applied twice! ROT-26 (Patent Pending). Don't leave home without it.
Re: Be warned, there's a nasty Google 2 factor auth attack going around
#24Earlier quoted context omitted.
I'd say it is two factor (googles implementation, the attack is classical social engineering): something you know (the password) and something you have (access to your phone).
In Google's implementation, only the "something you have" is really necessary for access. If you have the phone but not the password, you can just issue a password reset, which is confirmed via the phone, so the password doesn't function as a second factor independent of the phone.
[deleted]
Re: Be warned, there's a nasty Google 2 factor auth attack going around
#25Earlier quoted context omitted.
Account recovery is always a nagging weak spot. At some point, a user will forgot their password or lose their TFA device, and now you need them to be able to prove their identity outside of the usual flow. And if you have enough users, this has to be automated, leaving even more room for exploitation.
> And if you have enough users, this has to be automated Not really, they could just charge people $100 to retrieve a lost password and then do it manually.
Charging $100 is pretty punitive, but I've often wondered why more online services sensitive to attack don't use token credit card charges as a way to limit account duplication, increase complexity in a malicious operation, etc.
Stealing credit cards is cheap, yes, but the additional cost to using such a card on a password reset would still be a deterrent.
Re: Be warned, there's a nasty Google 2 factor auth attack going around
#26This isn't a 2 factor attack. It's a social engineering Google account password reset attack. The attacking party is resetting your Google password and asking you to provide the code Google sends your registered mobile number via text to them.
[deleted]
Re: Be warned, there's a nasty Google 2 factor auth attack going around
#27This is one of nice things about using a hardware security key (FIDO U2F), like Yubikey.
Since the security key works with the browser to ensure its communicating directly with a specific site, you can't MITM them like you can mobile app (TOTP) or SMS-based two-factor codes.
I wish more browsers would add support for them.
Re: Be warned, there's a nasty Google 2 factor auth attack going around
#28This isn't a 2 factor attack. It's a social engineering Google account password reset attack. The attacking party is resetting your Google password and asking you to provide the code Google sends your registered mobile number via text to them.
It is a 2 factor attack in the sense that it reduces the two factors down to one.
Re: Be warned, there's a nasty Google 2 factor auth attack going around
#29Earlier quoted context omitted.
> And if you have enough users, this has to be automated Not really, they could just charge people $100 to retrieve a lost password and then do it manually.
Charging $100 is pretty punitive, but I've often wondered why more online services sensitive to attack don't use token credit card charges as a way to limit account duplication, increase complexity in a malicious operation, etc. Stealing credit cards is cheap, yes, but the additional cost to using such a card on a password reset would still be a deterrent.
IMO it's not that bad, people are used to paying locksmiths that much when locked out of houses or vehicles.
Re: Be warned, there's a nasty Google 2 factor auth attack going around
#30While you're add it, verify that your password has not been hacked by entering it here: hxxp://evil.example.com/password-checker
hunter2