84 ms·
Use 2-Factor Auth. If you are a sysadmin make it required. Block image downloads by default. Turn on log in notifications for unknown devices. If you are a sysa
by Dangeranger 10y ago
Use 2-Factor Auth.
If you are a sysadmin make it required.
Block image downloads by default.
Turn on log in notifications for unknown devices.
If you are a sysadmin in a controlled network and serve content via proxy block bit.ly.
This is a clever and dangerous attack, but can still be avoided by following the above.
- chinathrow 10y agoThe 2FA token is valid for up to 1 minute and the attacker could easily ask for it as well... There were no image downloads, it was embedded within the message itself.
- Dangeranger 10y agoOk that's valid. Other than blocking bit.ly and other commercial link sharing services this seems to be a human hacking problem. It's hard to get people to be careful about checking the URL on a login page.