3 ms·
The phisher can just relay your token to establish a login from their end, and still have access to your account. In this article, the attacker created a filter
by function_seven 10y ago
The phisher can just relay your token to establish a login from their end, and still have access to your account. In this article, the attacker created a filter to move all incoming messages to Trash (that doesn't require a token to do), then they deleted the contacts (I don't think that requires a token), and kept an active connection to the Inbox (also doesn't require a token).
- klodolph 10y agoThis is true for the tokens which generate numbers you type in. I don't think it's the case for USB tokens, however.
- lucb1e 10y agoI have a USB token that's just a simulated keyboard, it doesn't do anything fancy like checking which URL I'm on. So, perhaps some do that, but definitely not all.