4 ms·

Well, on a phishing page the user could still type in the username and password before clicking submit. Only after submitting the username and password do authe

by kovek 10y ago

Well, on a phishing page the user could still type in the username and password before clicking submit. Only after submitting the username and password do authentication layers require the user to interact with their mobile device (which is usually how it works). Some users might forget that they are supposed to 2FA (say, on their first few days at the job). What if the password input would only be shown after the user typed in their username, pressed submit and confirmed that they were trying to log in using their mobile device? * Input username * Press submit * Interact with mobile device for 2FA * Input password * Press submit

andrewla 10y ago
Adding 2fa does not completely close the exploit window, but it does reduce it considerably. Even if the phishing page prompted for 2fa, those credentials would only be valid for the next ~60-120 seconds, so any attack would have to be staged very quickly. In this example, they waited three days before trying to utilize the broken account; with 2fa they would not have that luxury. And this (asking for 2fa in the phishing page) would entail a risk as well; if they prompted a user who did not have 2fa for their 2fa credentials, then they would immediately be (at best) confused, and possibly suspicious, so they would have to decide to take the risk as to whether to attempt to target 2fa'ed accounts. And if they don't offer a 2fa prompt, then the phishing attempt has fizzled, as even with the password, they only have one factor. Any sort of re-ordering of the login process by the good guys is only effective if the customer is extremely suspicious of changes in the login process, which nobody will be. The phishing site is under no obligation to match their flow to that of the faked website unless not matching by itself would be suspicious.
- jjnoakes 10y ago
  Why couldn't the attacker page pass on the 2fa token immediately to Google and log in as the victim? Then the attacker would have a month or so, not 30 seconds, with which to abuse their account
  - andrewla 10y ago
    That's why I said that it narrowed the exploit and what I meant by "[staging] very quickly". It's a more narrow window, and the other objections (like prompting non-2fa users for 2fa) still apply. If a human has to be involved on the attacker side, then this gets tricky, since they only have a short window where the 2fa is valid. If an automated process is trying to log on, then it is possible that CAPTCHAs would either prevent getting a full interactive session (i.e. just a "read email" level of access, as for an app) or block the attack entirely.
    - jjnoakes 10y ago
      If you are a MITM you don't have to prompt non-2fa users for 2fa. You just replay their credentials, live, on the real site, and if the real site is asking you for 2fa, then you ask the real user for their 2fa.
wojcikstefan 10y ago
I think the point here is that, even if you give away your password, the attacker won't be able to access your account, because you're protected by 2FA. If 2FA was supposed to protect your password from being phished, then it would have to prompt you for your 2FA code every time you log in, which would be pretty annoying.
- jjnoakes 10y ago
  And even that isn't good enough when you get mitmd.

by kovek 10y ago

andrewla 10y ago

Adding 2fa does not completely close the exploit window, but it does reduce it considerably. Even if the phishing page prompted for 2fa, those credentials would only be valid for the next ~60-120 seconds, so any attack would have to be staged very quickly. In this example, they waited three days before trying to utilize the broken account; with 2fa they would not have that luxury. And this (asking for 2fa in the phishing page) would entail a risk as well; if they prompted a user who did not have 2fa for their 2fa credentials, then they would immediately be (at best) confused, and possibly suspicious, so they would have to decide to take the risk as to whether to attempt to target 2fa'ed accounts. And if they don't offer a 2fa prompt, then the phishing attempt has fizzled, as even with the password, they only have one factor. Any sort of re-ordering of the login process by the good guys is only effective if the customer is extremely suspicious of changes in the login process, which nobody will be. The phishing site is under no obligation to match their flow to that of the faked website unless not matching by itself would be suspicious.

jjnoakes 10y ago
Why couldn't the attacker page pass on the 2fa token immediately to Google and log in as the victim? Then the attacker would have a month or so, not 30 seconds, with which to abuse their account
- andrewla 10y ago
  That's why I said that it narrowed the exploit and what I meant by "[staging] very quickly". It's a more narrow window, and the other objections (like prompting non-2fa users for 2fa) still apply. If a human has to be involved on the attacker side, then this gets tricky, since they only have a short window where the 2fa is valid. If an automated process is trying to log on, then it is possible that CAPTCHAs would either prevent getting a full interactive session (i.e. just a "read email" level of access, as for an app) or block the attack entirely.
  - jjnoakes 10y ago
    If you are a MITM you don't have to prompt non-2fa users for 2fa. You just replay their credentials, live, on the real site, and if the real site is asking you for 2fa, then you ask the real user for their 2fa.

wojcikstefan 10y ago

I think the point here is that, even if you give away your password, the attacker won't be able to access your account, because you're protected by 2FA. If 2FA was supposed to protect your password from being phished, then it would have to prompt you for your 2FA code every time you log in, which would be pretty annoying.

jjnoakes 10y ago
And even that isn't good enough when you get mitmd.