Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Kurt Got Got

fly.io

Post reply on HN
Print view View original

31–40 of 256 posts

Re: Kurt Got Got

#31

Post by dilyevsky »

tptacek wrote: post #22
Y_Y wrote: post #17

Earlier quoted context omitted.

Counterpoint: don't use passkeys, they're a confused mess and add limitations while not giving any benefits over a good long password in a password manager.

This whole story is about us getting zapped because we relied on a good long password in a password manager!

So what happened exactly? Did Kurt enter his twitter password manually after clicking on that phishing link? Did he not get his sus detector going off after the password manager didn't suggest the password?

Re: Kurt Got Got

#32

Post by ChrisMarshallNY »

stavros wrote: post #16
ChrisMarshallNY wrote: post #15

Earlier quoted context omitted.

If you grok Apple, I wrote up a tutorial on very basic PassKey implementation (for iOS apps), here: https://littlegreenviper.com/series/passkeys/

Very nice, thanks! By the way, the preferred capitalization is "passkeys", like "passwords". It's not supposed to be capitalized like a proper noun.

I prefer all lowercase. Not sure where I got the CamelCase version, but it may have been from the Apple or FIDO docs.

I’d like to write a follow-up that covers authentication apps/devices, but I need to do some research, and find free versions.

Re: Kurt Got Got

#33

Post by akerl_ »

latchkey wrote: post #29
silexia wrote: post #21

CEO here, I also almost got taken by a fake legal notice about a Facebook post. My password manager would not auto enter my password so I tried manually entering it like a dummy. Fortunately, it was the wrong one.

This is exactly why I turned off auto enter.

Isn’t turning off auto enter exacerbating the problem?

The avenue for catching this is that the password manager’s autofill won’t work on the phishing site, and the user could notice that and catch that it’s a malicious domain

Re: Kurt Got Got

#34

Post by paxys »

> This is, in fact, how all of our infrastructure is secured at Fly.io; specifically, we get everything behind an IdP (in our case: Google’s) and have it require phishing-proof MFA.

Every system is only as secure as its weakest link. If the company's CEO is idiotic enough to pull credentials from 1Password and manually copy-past them on a random website whose domain does not match the service that issued it, what is to say they won't do the same for an MFA token?

Re: Kurt Got Got

#35

Post by o11c »

dewey wrote: post #19
Y_Y wrote: post #17

Earlier quoted context omitted.

Counterpoint: don't use passkeys, they're a confused mess and add limitations while not giving any benefits over a good long password in a password manager.

They prevent you from being one of these, and copy pasting the password from password manager into the wrong input field. Something that still happens often with many websites not properly auto-filling from password managers. > They just rely on you being busy, or out, or tired, and just not checking closely enough

If you are "copy-pasting" you are not using your password manager correctly.

Re: Kurt Got Got

#36

Post by stavros »

dilyevsky wrote: post #31
tptacek wrote: post #22

Earlier quoted context omitted.

This whole story is about us getting zapped because we relied on a good long password in a password manager!

So what happened exactly? Did Kurt enter his twitter password manually after clicking on that phishing link? Did he not get his sus detector going off after the password manager didn't suggest the password?

That happened to me as well, I put it down to "fucking password manager, it's broken again".

For example, BitWarden has spent the past month refusing to auto fill fields for me. Bugs are really not uncommon at all, I'd think my password manager is broken before I thought I'm getting phished (which is exactly how they get you).

Re: Kurt Got Got

#37

Post by tptacek »

paxys wrote: post #34

> This is, in fact, how all of our infrastructure is secured at Fly.io; specifically, we get everything behind an IdP (in our case: Google’s) and have it require phishing-proof MFA. Every system is only as secure as its weakest link. If the company's CEO is idiotic enough to pull credentials from 1Password and manually copy-past them on a random website whose domain does not match the service that issued it, what is…

The. whole. point. of. phishing-resistant. MFA. is. that. you. can't. do. the. same. thing.

Re: Kurt Got Got

#38

Post by dilyevsky »

bradgessler wrote: post #13

When we did annual pen testing audits for my last company, the security audit company always offered to do phishing or social engineering attacks, but advised against it because they said it worked every single time. One of the most memorable things they shared is they'd throw USB sticks in the parking lot of the company they were pentesting and somebody would always put the thing into a workstation to see what as on…

The stray USB stick is how Stuxnet allegedly got deployed. Tbh I doubt that works in this day and age.

Re: Kurt Got Got

#40

Post by akerl_ »

paxys wrote: post #34

> This is, in fact, how all of our infrastructure is secured at Fly.io; specifically, we get everything behind an IdP (in our case: Google’s) and have it require phishing-proof MFA. Every system is only as secure as its weakest link. If the company's CEO is idiotic enough to pull credentials from 1Password and manually copy-past them on a random website whose domain does not match the service that issued it, what is…

FIDO2 won’t send an authentication to a fake site, no matter what the human does.

That’s what makes it phishing-resistant.

Post reply on HN