4 ms·
At my company we get these things 2-3 times a year. Surprisingly many people understand that there is something fishy. But "Surprisingly many" is not enough. 2
by callesgg 10y ago
At my company we get these things 2-3 times a year.
Surprisingly many people understand that there is something fishy. But "Surprisingly many" is not enough.
2FA is not enough here a user that does not have the required knowledge to see what is phishing and what is not will most likely enter the 2FA key giving the bad guys the auth tokens anyway.
- ryanobjc 10y agoThat's why yubikey is important - it does it's own verification of the site. You can't MITM it.
- wfunction 10y agoDid not know! Thanks for mentioning!
- mackmgg 10y agoNewer Yubikeys support U2F, which I haven't seen any way to phish yet, but the Yubikey protocol is still possible to phish. To do this, the fake login page says that the token was incorrect the first time (which would possibly alert some people, but certainly not everyone), and then when the user submits a second token, the phishing site sends the first one to the real site. They now have an unused token which can be used up until the user logs into another website (thus invalidating the 'unused' one).
- bjackman 10y agoAt my workplace we hire a company to do occasional phishing attacks on employees. If you get got (I have been got) you are briefly made to feel foolish and have to do a training course. They release stats and like you I was surprised how few people fall for it. But people always fall for it. I think this forced exposure to phishing attacks is an excellent idea.
- bjackman 10y agoAt my workplace we hire a company to do occasional phishing attacks on employees. If you get got (I have been got) you are briefly made to feel foolish and have to do a training course. They release stats and like you I was surprised how few people fall for it. But people always fall for it. I think this forced exposure to phishing attacks is an excellent idea.