51–60 of 61 posts
So the scam is, attacker knows your gmail address and your phone number. They send you the text message about suspicous activity on your account. Then they attempt to reset the password on your gmail account. That triggers Google to send you the code. You reply to the attacker's message with the code as instructed, and they own your account.
Again, this is a social engineering attack. 2-factor remains mathematically secure.
Earlier quoted context omitted.
In Google's implementation, only the "something you have" is really necessary for access. If you have the phone but not the password, you can just issue a password reset, which is confirmed via the phone, so the password doesn't function as a second factor independent of the phone.
Whoa. I hadn't realized this. So someone that knows my email address and has my phone has access to my entire life, because all password resets use my email address. If it's come to this, to using "something you have", then we can all go back to using paper password notebooks. They offer the same security, surprisingly.
I wonder if this is at all related to a phishing attempt that just got my mom and all her friends. It came in as a "docusign" email that looked reasonably legit (to an ordinary person) that just had one button to sign and review a document. Apparently they asked for email, email password, and phone number. I was surprised to learn about the phone number bit and how they'd use it. Something like this is probably how.…
> "I figured if it was coming from you it would be real." You should set up a strict DMARC policy (p=reject) to prevent people from spoofing your email address. It appears that you have not[1]. Additionally, you should harden your SPF record: change ~all to -all. [1]: https://dmarcian.com/record-tools/azinman.com
It also was my mom that was phished, not me.
So the scam is, attacker knows your gmail address and your phone number. They send you the text message about suspicous activity on your account. Then they attempt to reset the password on your gmail account. That triggers Google to send you the code. You reply to the attacker's message with the code as instructed, and they own your account.
Again, this is a social engineering attack. 2-factor remains mathematically secure.
U2F is the fix for this.
Earlier quoted context omitted.
Whoa. I hadn't realized this. So someone that knows my email address and has my phone has access to my entire life, because all password resets use my email address. If it's come to this, to using "something you have", then we can all go back to using paper password notebooks. They offer the same security, surprisingly.
That's a bit extreme. You could just put a passcode on your phone?
Earlier quoted context omitted.
That's a bit extreme. You could just put a passcode on your phone?
There have been many attacks in Russia where attackers would get a duplicate sim card from the operator (either with a bribe or a forged passport) and then proceed to hack everything linked to it - gmail, banks, facebook, etc
Earlier quoted context omitted.
There have been many attacks in Russia where attackers would get a duplicate sim card from the operator (either with a bribe or a forged passport) and then proceed to hack everything linked to it - gmail, banks, facebook, etc
At that point (identify fraud) there's very little you can do short of not allowing password resets. Even if you have a human customer support rep to verify your identity prior to resetting a password, you can just send your forged identity documents.
Earlier quoted context omitted.
> "I figured if it was coming from you it would be real." You should set up a strict DMARC policy (p=reject) to prevent people from spoofing your email address. It appears that you have not[1]. Additionally, you should harden your SPF record: change ~all to -all. [1]: https://dmarcian.com/record-tools/azinman.com
It's not a spoof when you're phished and hand over your credentials. It also was my mom that was phished, not me.
I'm saying that people cannot send emails to your mother pretending to be you if you were to implement the changes I have suggested.
I didn't say you were phished, I said you were spoofed. Judging by your first comment, your email address being spoofed is how your mother was phished.
Earlier quoted context omitted.
It's not a spoof when you're phished and hand over your credentials. It also was my mom that was phished, not me.
Sorry, I don't think you understand. I'm saying that people cannot send emails to your mother pretending to be you if you were to implement the changes I have suggested. I didn't say you were phished, I said you were spoofed. Judging by your first comment, your email address being spoofed is how your mother was phished.
Earlier quoted context omitted.
Charging $100 is pretty punitive, but I've often wondered why more online services sensitive to attack don't use token credit card charges as a way to limit account duplication, increase complexity in a malicious operation, etc. Stealing credit cards is cheap, yes, but the additional cost to using such a card on a password reset would still be a deterrent.
> Charging $100 is pretty punitive Not really, considering there is zero reason for anyone to ever lose a password assuming they are using a password manager. You could even make it free for the first few hours after the account is created or the password is changed in case the user pastes it into their password manager incorrectly.
Oh, so in other words; a tiny fraction of the internet using public?