Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The closest I've ever come to falling for a Gmail phishing attack

twitter.com

Post reply on HN
Print view View original

271–280 of 289 posts

Re: The closest I've ever come to falling for a Gmail phishing attack

#271

Post by tripzilch »

Bamberg wrote: post #213
jonoberheide wrote: post #160

Earlier quoted context omitted.

Sorry to hear about your experience, Jarwain! Duo offers a choice of authentication methods, depending on the usability and security requirements of your application or organization. Duo Push is actually one of the easiest (and most secure) authentication methods, as one of the commenters pointed out: https://www.youtube.com/watch?v=tPLxe9HUDjY It might be worth pinging your IT/security dept to ask about enabling Duo…

Duo does work as advertised, and my uni uses it, but the privacy policy allows for a lot of personal data collection. tldr: "Duo Security does not sell, rent, or trade and, except as described in this Privacy Policy, does not share any Personal Information with third parties for their promotional purposes." But Duo still collects A LOT of data on you. From the policy: "Device-Specific Information: We also collect dev…

also, if it's a US company and it ever goes bankrupt/sells its assets, third party buyers aren't bound by any privacy policy whatsoever. yes, this is crazy and it means US privacy policies are basically meaningless; best just don't give them your data, but what can you do. personally I believe that collecting the data and pretending a privacy policy makes it okay, is nefarious by itself already.

Re: The closest I've ever come to falling for a Gmail phishing attack

#272

Post by cyberferret »

mikeash wrote: post #132
danielbarla wrote: post #95

Earlier quoted context omitted.

Yep, that's what I'm saying too. If you've fallen for providing 1FA, you'll fall for 2FA too, since you think it's legit.

Apple's 2FA for iCloud will likely avoid this if you're careful. They do a GeoIP lookup of where the request is coming from and show the approximate location of the login attempt before they show you the 2FA code. For example, when logging in legitimately from home, it'll say that there's a login attempt from the city where I live. In the likely case where the phisher's server isn't in this area, it'll show something…

Apple's 2FA is good, but their geo-location needs some work. I constantly get notifications that someone located 3000km away from me is trying to log in whenever I perform a 2FA sign on.

It's enough to concern me on the odd occasion that someone is trying a MITM attack.

I am guessing it is because in Australia, quite often the central server allocating IP addresses for our major ISPs can be in a completely different city?!?

Re: The closest I've ever come to falling for a Gmail phishing attack

#273

Post by Ajedi32 »

wopwopwop wrote: post #261
Ajedi32 wrote: post #222

Earlier quoted context omitted.

Huh? What are you even talking about? This comment makes no sense to me in the context of what jon-wood said. > the URL is not included in the hash What hash? Nobody even mentioned a hash. The crypto keys used for U2F are indeed domain-specific, if that's what you're trying to ask. > It could be by having those two talk to each other. Who's "those two"? And what's "it"? I'm very confused.

> What hash? Nobody even mentioned a hash. I mentioned a hash. The secret is hashed together with the time. _That_ hash. > The crypto keys used for U2F are indeed domain-specific, if that's what you're trying to ask. I know the secret is domain-specific. What I was describing is taking the secret, and the time AND THE DOMAIN and use them to produce the hash. This would break MITM. One of the comments above me mention…

> I mentioned a hash.

I think you're confused. You have not mentioned the word "hash" even once in this thread prior to the previous comment I replied to.

Anyway, I think you're confusing U2F with TOTP. U2F does not rely on the time at all AFAIK; it uses public key cryptography, and authenticates by signing a data structure containing the domain name of the site and a server-provided nonce (among other things).

> What I was describing is taking the secret, and the time AND THE DOMAIN and use them to produce the hash.

I think there's still some sort of disconnect here, because up until this this comment you've described nothing of the sort in this thread. Could you link the comment you're referring to where you explained all this?

> One of the comments above me mentioned this and I run with it.

If you're referring to acdha's comment about U2F, as acdha and others in this thread have explained, U2F (aka Universal 2nd Factor) is an entirely different protocol from TOTP (aka Time-based One Time Password). U2F does not use hashing or the system time in the way you seem to be envisioning, but it is also not vulnerable to phishing like TOTP is.

U2F interfaces with your browser, and uses a set of public and private keys (that is stored on the U2F device, not in your browser) to authenticate to sites in a way which can't be phished. It's not theoretical; it exists and can be used today with many popular sites, including Google, GitHub, Dropbox, and more. You just need a USB device which supports U2F (YubiKey is one, but there are many others).

Re: The closest I've ever come to falling for a Gmail phishing attack

#274

Post by anchpop »

jdavis703 wrote: post #244
hobarrera wrote: post #203

Earlier quoted context omitted.

Probably not; the fake page can also prompt for the second factor and then quickly do the real authentication using that.

This is why having a warning for non-HTTPs sites is so important: http://boingboing.net/2016/11/05/chrome-is-about-to-start-wa... .

I don't see how that would help here. Couldn't the phishing site have HTTPS?

Re: The closest I've ever come to falling for a Gmail phishing attack

#276

Post by ronnier »

kinkrtyavimoodh wrote: post #224
ronnier wrote: post #177

My rule for gmail... I type gmail.com then log in. That's the only path I take to log in. I never click a link and log in, etc. really I do this for most sites I use.

What do you do for "Sign in with your Google Account" situations?

I don't. I don't sign in with my gmail anywhere. It has the keys to my kingdom, so I treat it with special care.

Re: The closest I've ever come to falling for a Gmail phishing attack

#277

Post by twostoned »

zbuf wrote: post #250

The problem here is monopoly, or mono culture. The whole world is, basically, using one email client. The lack of diversity means a well written scam like this spreads easily. I can say for certain I'd never fall for this scam -- because it looks like crap in Pine. I know I'm special, but the same applies to Thunderbird, or whatever. There's probably a parallel to biology here. Let's get diversity back in our interne…

I have been reading the comments wondering if this was a specific GMail webmail thing. I'm guessing that using IMAP or POP3 through an email client will make this harder? I'm by no means without risk but I rarely use the GMail web-client so wasn't sure exactly what the scam was

Re: The closest I've ever come to falling for a Gmail phishing attack

#278

Post by swiley »

sethrin wrote: post #258
swiley wrote: post #102

Earlier quoted context omitted.

Far better would be to not render HTML emails at all. They're an abomination and have always been causing security problems of different kinds.

> All programs will attempt to expand until they can render HTML emails. Those that cannot will be replaced by those that can. More seriously, the expectation that emails will consist only of plain text is simply untenable. From a security standpoint this is obviously not ideal, but security and usability are opposed, and if your security scheme does not allow users to send documents with some form of markup, it will…

Emails had a form of markup before HTML emails came, it was the inspiration for markdown.

Re: The closest I've ever come to falling for a Gmail phishing attack

#279

Post by fnl »

gaia wrote: post #239
colinbartlett wrote: post #64

Earlier quoted context omitted.

Requiring 2-factor auth would prevent this from being exploitable, right? Probably impossible in a school environment but in an enterprise situation, more palatable perhaps.

2FA would make it harder to exploit, but phishing attacks are getting fancier. They capture the 2FA code you enter and immediately start a session elsewhere with your password and 2FA. Hardware 2FA, a security key, (such as a Yubikey) is the only likely way to prevent phishing (excluding targets of state actors) https://support.google.com/accounts/answer/6103523?hl=en

> They capture the 2FA code

How can that be done? That's between my phone and Google, so how can they "listen in" on that?

Re: The closest I've ever come to falling for a Gmail phishing attack

#280

Post by mikeash »

cyberferret wrote: post #272
mikeash wrote: post #132

Earlier quoted context omitted.

Apple's 2FA for iCloud will likely avoid this if you're careful. They do a GeoIP lookup of where the request is coming from and show the approximate location of the login attempt before they show you the 2FA code. For example, when logging in legitimately from home, it'll say that there's a login attempt from the city where I live. In the likely case where the phisher's server isn't in this area, it'll show something…

Apple's 2FA is good, but their geo-location needs some work. I constantly get notifications that someone located 3000km away from me is trying to log in whenever I perform a 2FA sign on. It's enough to concern me on the odd occasion that someone is trying a MITM attack. I am guessing it is because in Australia, quite often the central server allocating IP addresses for our major ISPs can be in a completely different…

That's too bad. Do other services get it right?
Post reply on HN