Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The closest I've ever come to falling for a Gmail phishing attack

twitter.com

Post reply on HN
Print view View original

251–260 of 289 posts

Re: The closest I've ever come to falling for a Gmail phishing attack

#251

Post by rvern »

mderazon wrote: post #18
witty_username wrote: post #14

To stop being phished always check the domain name and for HTTPS before entering passwords.

Don't trust HTTPS, any malicious site can get certificate very easily. I once almost fell for a smart Airbnb phishing attack. At some point, I was directed to https://www.airbnb.com.eubook.net/en/instant/rooms/2685603?c... to complete my booking. Website had perfectly valid SSL cert (doesn't anymore) and more importantly, check out the domain name ! Almost missed the .eubook.net part!

That's why witty_username said to check the domain name and for HTTPS, not just for HTTPS.

Re: The closest I've ever come to falling for a Gmail phishing attack

#252

Post by semi-extrinsic »

shimon_e wrote: post #245
gaia wrote: post #239

Earlier quoted context omitted.

2FA would make it harder to exploit, but phishing attacks are getting fancier. They capture the 2FA code you enter and immediately start a session elsewhere with your password and 2FA. Hardware 2FA, a security key, (such as a Yubikey) is the only likely way to prevent phishing (excluding targets of state actors) https://support.google.com/accounts/answer/6103523?hl=en

> Hardware 2FA, a security key, (such as a Yubikey) is the only likely way to prevent phishing For now.

Or manual challenge-response, like some internet banking tokens have.

Re: The closest I've ever come to falling for a Gmail phishing attack

#253

Post by suprjami »

The closest I ever came was a Nigerian scam where a crown prince had been one of the first people on a space station in the 90s, but his return seat was taken up by cargo when they decommissioned the satellite, so they just left him in orbit.

After 15 years alone in space he was "in good spirits" but wanted to come home and would share his overtime flight pay of $15M with me.

Seriously where do they find these stories.

Re: The closest I've ever come to falling for a Gmail phishing attack

#254

Post by intrasight »

Bamberg wrote: post #214
intrasight wrote: post #194

Earlier quoted context omitted.

I hadn't heard of Duo. Just looked briefly at the site. Does anyone have a TL;DR on that? Why would one use that rather than the native 2FA?

They can send push requests that you can just approve on your mobile device, no typing in those codes. They also have backup methods that work w/o needing internet access on your phone. I think institutions also use Duo because Duo takes care of the whole think whereas traditional 2FA isn't trivial to implement for the institution (generating tokens and all of that). At least that's what I was told by my institution…

> takes care of the whole thing But I would have assumed that there is considerable work necessary on the backend for a web server to integrate with Duo.

Re: The closest I've ever come to falling for a Gmail phishing attack

#255

Post by acchow »

jlebar wrote: post #249
acchow wrote: post #246

Earlier quoted context omitted.

Why would a yubikey prevent this? They can still send the 2FA code to Google to start your session...

No, they cannot with the U2F protocol (as implemented by yubikey). The simplified version is, Google sends the browser a one-time key, which the browser forwards to the HW token to sign with its private key. Then the browser sends this back to the web server to verify, using its copy of the HW token's public key. This would be vulnerable to MITM attacks, as you say. So what the protocol actually does is concatenate t…

Oh I think I've never used this feature with my Yubikey - it's just been essentially an external keyboard that types rather quickly.

Re: The closest I've ever come to falling for a Gmail phishing attack

#256

Post by e40 »

jneal wrote: post #98
timruffles wrote: post #32

I reported this a back in March 2016, and Google said it was not an issue. Analysed whole attack here: https://gist.github.com/timruffles/5c76d2b61c88188e77f6 This was the response I got: > The address bar remains one of the few trusted UI components of the browsers and is the only one that can be relied upon as to what origin are the users currently visiting. If the users pay no attention to the address bar, phishin…

This is pretty scary. When you hear security professionals explain to laymen how to identify phishing attacks, it's almost always check the URL, make sure you're actually at google.com and not go0gle.com, or something like that. I can't even imagine what legitimate use there is to placing an entire HTML document into the URL. Just seems like a hack someone came up with as a solution to a problem, not the right soluti…

make sure you're actually at google.com and not go0gle.com

And how about the domain with a character that looks more like 'o' than '0'? There was something on HN recently about that. The example given would have completely fooled me, since it looked the same as the real domain.

Re: The closest I've ever come to falling for a Gmail phishing attack

#258

Post by sethrin »

swiley wrote: post #102
willvarfar wrote: post #52

Earlier quoted context omitted.

And stop people emailing screen shots? The best approach I can come up with after five seconds thought is disabling links on non-text elements. And then they go make an anchor that is whitespace over top of a background image... so we'd also need to disable links on large expanses of empty whitespace in text when its embedded in a mail. I should think that can likely be worked around too, however. Got any more ideas?

Far better would be to not render HTML emails at all. They're an abomination and have always been causing security problems of different kinds.

> All programs will attempt to expand until they can render HTML emails. Those that cannot will be replaced by those that can.

More seriously, the expectation that emails will consist only of plain text is simply untenable. From a security standpoint this is obviously not ideal, but security and usability are opposed, and if your security scheme does not allow users to send documents with some form of markup, it will not be widely used.

Re: The closest I've ever come to falling for a Gmail phishing attack

#259

Post by vilhelm_s »

kinkrtyavimoodh wrote: post #224
ronnier wrote: post #177

My rule for gmail... I type gmail.com then log in. That's the only path I take to log in. I never click a link and log in, etc. really I do this for most sites I use.

What do you do for "Sign in with your Google Account" situations?

Shouldn't this still work? I think if you are signed in on gmail, then if a third-party site asks you to log in, it will pop up a window with just a button saying "authorize", you should not be asked to enter your password again...

Re: The closest I've ever come to falling for a Gmail phishing attack

#260

Post by seanp2k2 »

e40 wrote: post #256
jneal wrote: post #98

Earlier quoted context omitted.

This is pretty scary. When you hear security professionals explain to laymen how to identify phishing attacks, it's almost always check the URL, make sure you're actually at google.com and not go0gle.com, or something like that. I can't even imagine what legitimate use there is to placing an entire HTML document into the URL. Just seems like a hack someone came up with as a solution to a problem, not the right soluti…

make sure you're actually at google.com and not go0gle.com And how about the domain with a character that looks more like 'o' than '0'? There was something on HN recently about that. The example given would have completely fooled me, since it looked the same as the real domain.

https://en.m.wikipedia.org/wiki/IDN_homograph_attack is what you're referencing, I believe :)
Post reply on HN