3 ms·

2 factor doesn't protect against phishing. It's trivial for a phishing site to ask for a 2fa code, and then immediately use that to sign in on your behalf.

philrapo 11y ago
that's why you always voice confirm...
ryan-c 11y ago
Have you ever seen a phishing attack that actually asks for and uses the two factor auth code? I don't deny that this is possible, I've just never seen it.
- eli 11y ago
  Not only is it possible, it really isn't very hard to execute. It takes some basic web programming skills. It's been seen in the wild: https://www.schneier.com/blog/archives/2009/09/hacking_two-fac.html https://www.schneier.com/blog/archives/2009/09/hacking_two-f...
- adrianmacneil 11y ago
  I haven't been targeted by one myself, but I've definitely heard of it happening. When the stakes are this high (million dollar+ payouts), attackers spend months infiltrating organizations, and adding 2fa to what is already a custom spear phishing page is not that much of a hurdle.
devit 11y ago
I think Google asks for 2-factor only when you are connecting from a new browser/device, so it would be highly suspicious to see that happening randomly. Of course, the fact that he's asked for a password while being already logged in on Gmail is also suspicious, but less so since other sites do that.
- eli 11y ago
  A new computer, and also every 30 days or if it detects something "suspicious." So, no, it wouldn't seem that unusual to be prompted to login again.
- adrianmacneil 11y ago
  It's definitely suspicious. However, often it's not enough to trigger any alarm bells. It's fairly easy to mindlessly type in password/2fa codes into a website ("stupid google asking for my password again") rather than automatically think about a potential phishing attack. While I haven't see it reported whether or not they had 2fa enabled, we can hope that they had taken this very basic security measure. Actually one of the best preventions against this is using a password manager. I was nearly caught by a phishing site once, and I only noticed because 1Password was refusing to autofill the password field.

philrapo 11y ago

that's why you always voice confirm...

ryan-c 11y ago

Have you ever seen a phishing attack that actually asks for and uses the two factor auth code? I don't deny that this is possible, I've just never seen it.

eli 11y ago
Not only is it possible, it really isn't very hard to execute. It takes some basic web programming skills. It's been seen in the wild: https://www.schneier.com/blog/archives/2009/09/hacking_two-fac.html https://www.schneier.com/blog/archives/2009/09/hacking_two-f...
adrianmacneil 11y ago
I haven't been targeted by one myself, but I've definitely heard of it happening. When the stakes are this high (million dollar+ payouts), attackers spend months infiltrating organizations, and adding 2fa to what is already a custom spear phishing page is not that much of a hurdle.

devit 11y ago

I think Google asks for 2-factor only when you are connecting from a new browser/device, so it would be highly suspicious to see that happening randomly. Of course, the fact that he's asked for a password while being already logged in on Gmail is also suspicious, but less so since other sites do that.

eli 11y ago
A new computer, and also every 30 days or if it detects something "suspicious." So, no, it wouldn't seem that unusual to be prompted to login again.
adrianmacneil 11y ago
It's definitely suspicious. However, often it's not enough to trigger any alarm bells. It's fairly easy to mindlessly type in password/2fa codes into a website ("stupid google asking for my password again") rather than automatically think about a potential phishing attack. While I haven't see it reported whether or not they had 2fa enabled, we can hope that they had taken this very basic security measure. Actually one of the best preventions against this is using a password manager. I was nearly caught by a phishing site once, and I only noticed because 1Password was refusing to autofill the password field.