3 ms·
I think most "technical" users would have two-factor authentication enabled which would prevent this type of attack.
by amnezia 10y ago
I think most "technical" users would have two-factor authentication enabled which would prevent this type of attack.
- dividuum 10y ago> [...] which would prevent this type of attack. Depends. See the discussion in the previous post about this: https://news.ycombinator.com/item?id=13372985 https://news.ycombinator.com/item?id=13372985
- laurencei 10y agoNo - because the phishing page can act as a MITM attack - where they display the 2-factor login on the phishing page - and post the entered code to Google, confirm they are in (and receive the cookie enabling access) - while displaying the page back to you. So 2-factor actually provides a false sense of security here. Edit: unless you have U2F as per @makomk comment below
- makomk 10y agoUnless the second factor is U2F, because the actual domain is handed to the U2F dongle by the browser and the authentication is tied to that.
- laurencei 10y agoThanks - good point :) But for the Google Authenticator and SMS - it would still be vulnerable.
- kevin2r 10y agoWhat about getting a text message in your phone, a call, or the google mobile app? Will it be effective against this kind of attack?