Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The closest I've ever come to falling for a Gmail phishing attack

twitter.com

Post reply on HN
Print view View original

261–270 of 289 posts

Re: The closest I've ever come to falling for a Gmail phishing attack

#261

Post by wopwopwop »

Ajedi32 wrote: post #222
wopwopwop wrote: post #192

Earlier quoted context omitted.

I know how it is now , but that's not what I'm talking about. Currently the URL is not included in the hash, that's my point. It could be by having those two talk to each other. Who's the server and who's the client is beside my point.

Huh? What are you even talking about? This comment makes no sense to me in the context of what jon-wood said. > the URL is not included in the hash What hash? Nobody even mentioned a hash. The crypto keys used for U2F are indeed domain-specific, if that's what you're trying to ask. > It could be by having those two talk to each other. Who's "those two"? And what's "it"? I'm very confused.

> What hash? Nobody even mentioned a hash.

I mentioned a hash. The secret is hashed together with the time. _That_ hash.

> The crypto keys used for U2F are indeed domain-specific, if that's what you're trying to ask.

I know the secret is domain-specific. What I was describing is taking the secret, and the time AND THE DOMAIN and use them to produce the hash. This would break MITM. One of the comments above me mentioned this and I run with it. But you're talking to me like you didn't read anything above....

> Who's "those two"?

Those two are the yubikey and the browser.

Re: The closest I've ever come to falling for a Gmail phishing attack

#262

Post by Magicstatic »

seanp2k2 wrote: post #260
e40 wrote: post #256

Earlier quoted context omitted.

make sure you're actually at google.com and not go0gle.com And how about the domain with a character that looks more like 'o' than '0'? There was something on HN recently about that. The example given would have completely fooled me, since it looked the same as the real domain.

https://en.m.wikipedia.org/wiki/IDN_homograph_attack is what you're referencing, I believe :)

Interesting enough, HN itself was actually susceptible to this and it was reported by a security researcher:

https://news.ycombinator.com/security.html

Re: The closest I've ever come to falling for a Gmail phishing attack

#264

Post by hobarrera »

jdavis703 wrote: post #244
hobarrera wrote: post #203

Earlier quoted context omitted.

Probably not; the fake page can also prompt for the second factor and then quickly do the real authentication using that.

This is why having a warning for non-HTTPs sites is so important: http://boingboing.net/2016/11/05/chrome-is-about-to-start-wa... .

Yup, hopefully that would make a difference, though if we keep getting news like today's GoDaddy validation bug, this'll gradually lose value. :(

Re: The closest I've ever come to falling for a Gmail phishing attack

#266

Post by acdha »

wopwopwop wrote: post #261
Ajedi32 wrote: post #222

Earlier quoted context omitted.

Huh? What are you even talking about? This comment makes no sense to me in the context of what jon-wood said. > the URL is not included in the hash What hash? Nobody even mentioned a hash. The crypto keys used for U2F are indeed domain-specific, if that's what you're trying to ask. > It could be by having those two talk to each other. Who's "those two"? And what's "it"? I'm very confused.

> What hash? Nobody even mentioned a hash. I mentioned a hash. The secret is hashed together with the time. _That_ hash. > The crypto keys used for U2F are indeed domain-specific, if that's what you're trying to ask. I know the secret is domain-specific. What I was describing is taking the secret, and the time AND THE DOMAIN and use them to produce the hash. This would break MITM. One of the comments above me mention…

I think most of us are having trouble understanding exactly the question which you're trying to ask – could you try to state it clearly and precisely?

Re: The closest I've ever come to falling for a Gmail phishing attack

#267

Post by greggman »

I actually did get phished by this. I think I just got lucky I had 2fa on and they didn't phish that too

http://blog.greggman.com/blog/getting-phished/

The worst thing is I don't know how to help my less technical friends not fall for it. They are unlikely to use 2fa I think

Post reply on HN