221–230 of 289 posts
Earlier quoted context omitted.
It's actually the other way round, the YubiKey (or other U2F token) has an API the browser queries, generally triggering the token requesting some sort of physical interaction.
I know how it is now , but that's not what I'm talking about. Currently the URL is not included in the hash, that's my point. It could be by having those two talk to each other. Who's the server and who's the client is beside my point.
> the URL is not included in the hash
What hash? Nobody even mentioned a hash. The crypto keys used for U2F are indeed domain-specific, if that's what you're trying to ask.
> It could be by having those two talk to each other.
Who's "those two"? And what's "it"? I'm very confused.
Correct me if I'm wrong, but that embedded image (pretending to be an attachment) redirects you to a (fake) Gmail login page. How is that supposed to trick anyone? I mean, isn't it unusual (i.e. never happens) for attachments to take you to a Gmail login page? So that's suspicious behaviour right there. How is it a serious phishing attack that's getting so much attention on a platform like HN where people are used to…
Part of why we're impressed (and dismayed) is that they use a data URL to look like "accounts.google.com" and to load a remote script out of sight to the right of all the spaces. Maybe the URL protocol didn't fool you, but I think there are a good number of users out there who have been "trained" to check the URL to see that it says "accounts.google.com" and think it's fine. And while clicking on an attachment should…
My rule for gmail... I type gmail.com then log in. That's the only path I take to log in. I never click a link and log in, etc. really I do this for most sites I use.
Sysadmin at a school: we use GMail for our students and faculty, and we got hit by this hard right before the holiday break. Three employees and a handful of students all got hit by the attack within a two hour period. It's the most sophisticated attack I've seen. The attackers log in to your account immediately once they get the credentials, and they use one of your actual attachments, along with one of your actual…
Requiring 2-factor auth would prevent this from being exploitable, right? Probably impossible in a school environment but in an enterprise situation, more palatable perhaps.
My rule for gmail... I type gmail.com then log in. That's the only path I take to log in. I never click a link and log in, etc. really I do this for most sites I use.
What do you do for "Sign in with your Google Account" situations?
Earlier quoted context omitted.
> 3. Kill re-authentications dead. Then I would forget my password, like I always forget my github password and have to reset it every leap year when i log out for some reason, but i guess that's a small price to pay.
you should invest in a password manager (i use keepass)
Case in point: I also use Authy with backup, but I don't store my backup password in the password manager, because that would be a potential single point of security failure. The app kindly asks for a backup password occasionally. It's not for access, but for reminder. In fact if I don't remember my password, I can reset it right there in the app. I find that feature very useful.
Earlier quoted context omitted.
Requiring 2-factor auth would prevent this from being exploitable, right? Probably impossible in a school environment but in an enterprise situation, more palatable perhaps.
U2F would prevent this from being exploitable, but one-time password schemes like TOTP would not.