Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The closest I've ever come to falling for a Gmail phishing attack

twitter.com

Post reply on HN
Print view View original

281–289 of 289 posts

Re: The closest I've ever come to falling for a Gmail phishing attack

#281

Post by Jarwain »

contravariant wrote: post #189
Jarwain wrote: post #184

Earlier quoted context omitted.

Its more the idea of rendering the HTML code in this fashion does not make sense to me. Maybe print the code to the page instead of rendering it. Anything would be better than rendering the code; I can't even come up with a possible use case for that functionality, can you?

You could generate a webpage and link to it without needing to host it somewhere. At any rate, if you allow a URI scheme that embeds the data in the URI itself it'd be very odd to arbitrarily restrict the valid MIME types. It'd be like forbidding a http URL from linking to a JPEG.

Well in a way you're just offloading the cost of hosting that code/data in that case. Instead of hosting it yourself, the page with the link is hosting that webpage.

Well it wouldn't really be arbitrary, it'd be specifically HTML and/or JS, for security related purposes.

Re: The closest I've ever come to falling for a Gmail phishing attack

#282

Post by putlake »

fnl wrote: post #279
gaia wrote: post #239

Earlier quoted context omitted.

2FA would make it harder to exploit, but phishing attacks are getting fancier. They capture the 2FA code you enter and immediately start a session elsewhere with your password and 2FA. Hardware 2FA, a security key, (such as a Yubikey) is the only likely way to prevent phishing (excluding targets of state actors) https://support.google.com/accounts/answer/6103523?hl=en

> They capture the 2FA code How can that be done? That's between my phone and Google, so how can they "listen in" on that?

The phishing site will ask you for your 2FA code and then enter it on the real Google login page.

Re: The closest I've ever come to falling for a Gmail phishing attack

#283

Post by jonoberheide »

Bamberg wrote: post #213
jonoberheide wrote: post #160

Earlier quoted context omitted.

Sorry to hear about your experience, Jarwain! Duo offers a choice of authentication methods, depending on the usability and security requirements of your application or organization. Duo Push is actually one of the easiest (and most secure) authentication methods, as one of the commenters pointed out: https://www.youtube.com/watch?v=tPLxe9HUDjY It might be worth pinging your IT/security dept to ask about enabling Duo…

Duo does work as advertised, and my uni uses it, but the privacy policy allows for a lot of personal data collection. tldr: "Duo Security does not sell, rent, or trade and, except as described in this Privacy Policy, does not share any Personal Information with third parties for their promotional purposes." But Duo still collects A LOT of data on you. From the policy: "Device-Specific Information: We also collect dev…

I think that's a fair read. The primary use of that data is for security use cases. Eg. if you're coming from an out-of-date browser or have risky Java/Flash plugin versions, we can notify you to update/remediate.

Another way to look at it: We collect security-relevant information on your device, but not your _personal_ data. In other words, we don't collect your email, photos, contacts, user-generated data, etc.

Re: The closest I've ever come to falling for a Gmail phishing attack

#284

Post by jonoberheide »

paulmd wrote: post #211
samch wrote: post #190

Earlier quoted context omitted.

I'm at a large research university, and we use Duo across the institution. It really does work as advertised. The Duo Push feature combined with my iPhone's TouchID is very convenient (Duo Push also works on other devices). Most importantly to me, though, the system has thus far been completely reliable. I haven't yet heard of a single case where somebody couldn't log in because of Duo. I'm not sure what our enterpri…

cc: @jonoberheide My Duo hardware token (the code generator with the button and the LCD) tends to "desynchronize" after long periods where you don't use it. The internal clock gets off, so it drifts in what token it returns vs what the server thinks it should be returning, and then it stops working. Normally, if you log in on a regular basis the server corrects for this drift. There is probably a sliding window of N…

Hi Paul! I believe your token should automatically resync if you enter three consecutive correct passcodes that are outside (but forward of) the current valid window.

Re: The closest I've ever come to falling for a Gmail phishing attack

#285

Post by [deleted] »

shimon_e wrote: post #245
gaia wrote: post #239

Earlier quoted context omitted.

2FA would make it harder to exploit, but phishing attacks are getting fancier. They capture the 2FA code you enter and immediately start a session elsewhere with your password and 2FA. Hardware 2FA, a security key, (such as a Yubikey) is the only likely way to prevent phishing (excluding targets of state actors) https://support.google.com/accounts/answer/6103523?hl=en

> Hardware 2FA, a security key, (such as a Yubikey) is the only likely way to prevent phishing For now.

[deleted]

Re: The closest I've ever come to falling for a Gmail phishing attack

#286

Post by smeehee »

gaia wrote: post #239
colinbartlett wrote: post #64

Earlier quoted context omitted.

Requiring 2-factor auth would prevent this from being exploitable, right? Probably impossible in a school environment but in an enterprise situation, more palatable perhaps.

2FA would make it harder to exploit, but phishing attacks are getting fancier. They capture the 2FA code you enter and immediately start a session elsewhere with your password and 2FA. Hardware 2FA, a security key, (such as a Yubikey) is the only likely way to prevent phishing (excluding targets of state actors) https://support.google.com/accounts/answer/6103523?hl=en

Google can prompt you to confirm the login via your phone. It appears to work well: there's a time-out, and this time-out is also triggered if a second login attempt is made in parallel (and reaches the confirmation stage).

So… whichever login attempt gets to confirmation stage last wins (not relevant in this situation), and the confirmation screen on (at least) my phone does not indicate anything regarding location (which is highly relevant).

This looks a little weaker than TOTP (you're basically trading a little security for the convenience of not entering a code while keeping the second factor) and a lot weaker than U2F.

Re: The closest I've ever come to falling for a Gmail phishing attack

#287

Post by AlexCoventry »

acchow wrote: post #255
jlebar wrote: post #249

Earlier quoted context omitted.

No, they cannot with the U2F protocol (as implemented by yubikey). The simplified version is, Google sends the browser a one-time key, which the browser forwards to the HW token to sign with its private key. Then the browser sends this back to the web server to verify, using its copy of the HW token's public key. This would be vulnerable to MITM attacks, as you say. So what the protocol actually does is concatenate t…

Oh I think I've never used this feature with my Yubikey - it's just been essentially an external keyboard that types rather quickly.

It's only available on newer yubikeys.

Re: The closest I've ever come to falling for a Gmail phishing attack

#288

Post by Jarwain »

jonoberheide wrote: post #167
Jarwain wrote: post #166

Earlier quoted context omitted.

Huh, I never would've expected to hear from the CTO just from making this post. Thanks for the reply! I'll definitely get in contact with the school's OIT to figure out alternate options for authentication

No prob! I can't claim to be a HN veteran (/me glares at @tqbf), but if I hear people are having issues, happy to help.

So it turns out I can still use the Duo Mobile app. I have to re-add the device. Not the most intuitive but then again I figured it out on my own -shrugs-

Re: The closest I've ever come to falling for a Gmail phishing attack

#289

Post by fnl »

putlake wrote: post #282
fnl wrote: post #279

Earlier quoted context omitted.

> They capture the 2FA code How can that be done? That's between my phone and Google, so how can they "listen in" on that?

The phishing site will ask you for your 2FA code and then enter it on the real Google login page.

Hmm, but that gets us back to "stage one": For that to work, you have to ignore your URL-bar...
Post reply on HN