7 ms·
I reported this attack vector to Google back in 2012. They awarded a modest bounty, and then a few months later I heard this: > "We're deploying some abuse det
by ademarre 9y ago
I reported this attack vector to Google back in 2012. They awarded a modest bounty, and then a few months later I heard this:
> "We're deploying some abuse detection and reactive measures to deal with impostors that might try to abuse this sort of attack. Given this, we do not intend to perform validation that the URL matches the branding information."
That last part was in reference to one of my proposed mitigations, which they chose not to implement.
Here's the discussion on the IETF OAuth WG mailing list from that same time period: https://www.ietf.org/mail-archive/web/oauth/current/msg07625.html https://www.ietf.org/mail-archive/web/oauth/current/msg07625...
- bwackwat 9y agoThis is the most valuable comment here.
- paulddraper 9y agoUnicode domain names, Google OAuth phishing...changing my passwords every 30 days is looking less and less important. It's sad we can't seem to provide good, usable secure software.
- machine-wisdom 9y agoWhen you change your Google password, all OAuth tokens are revoked. The next time you use an OAuth connected App you will have to authorize it again, hopefully not making the same mistake twice.
- zeeveener 9y agoThe problem, it seems, is that we are increasing the complexity of the "Secure Software" in an attempt to thwart the most sophisticated attacks. However, as many people are already thinking, Complexity reduces Security and Stability. Therefore, it seems that the more we try to fight the "hackers", the more likely we will add some insecurity which they can exploit.
- glubGlub 9y agoComplexity doesn't reduce security. Complexity can both improve and reduce security depending on specifics, and thus generalizes to "no correlation" demonstrating that generalizations are often misleading.
- bo1024 9y ago> changing my passwords every 30 days is looking less and less important. Sidenote: I don't think that was ever a good idea, unless you think you were likely to type your password into phishing sites in the last month.
- deleted 9y ago[deleted]
- paulddraper 9y agoSadly, PCI compliance requirements believe otherwise :(
- cortesoft 9y agoThe PCI requirement is to change passwords every 90 days.
- AstralStorm 9y agoAnd is patently silly, forcing the requirement to decrypt rarely used private keys every 90 days. The requirement should depend on password and hash strength, not some arbitrary decision. PCI does not recommend employing password entropy checkers either. 90 day password can be weak while passing all the requirements.
- Consultant32452 9y agoEverywhere I've worked appears to have their own way of circumventing the security of PCI requirements. On a military base I worked everyone used an easily recognizable pattern on the keyboard. Another place was something like [employer][symbol][123 or 321]. All too often people use the same pattern that the IT team uses when they reset your password. So if the IT team typically sets your password to WhyCombin@tor1, then everyone's going to cycle through 1-10. Making people reset their password every 90 days probably causes more problems than it solves and incentivizes more easily guessable passwords.
- 9y ago
- throwaway847345 9y agoPasswords for authentication was just always a flawed idea, typing them into the DOM and sending them over the wire even more so.
- xahrepap 9y agoI agree. However I have yet to see a better alternative. Are there any out there?
- paulddraper 9y agoBasic auth doesn't use the DOM.
- selfhatinmarxst 9y agocertificates
- wmil 9y agoDid they ever solve the privacy issues with browser client certificates?
- amenghra 9y agoTLS 1.3 may solve some things. It depends what you lean by "the privacy issues"...
- wmil 9y agoI'm not an expert or even particularly up to date, but I heard that other websites could see the client certificates installed. So a third party website might recognise the client certificate and know things about the user.
- ChristianBundy 9y agoAbsolutely! My favorite is usually referred to as passwordless authentication, and generally means that when a user gives you their email address/SMS/etc, you send a login link to their device. Here's an article: https://medium.com/@ninjudd/passwords-are-obsolete-9ed56d483eb https://medium.com/@ninjudd/passwords-are-obsolete-9ed56d483...
- pksadiq 9y ago> changing my passwords every 30 days is looking less and less important. Using some non-English Unicode text as password will make the password really strong. I sometimes include Malayalam text for passwords as it's my native language.
- jeffjose 9y agoOr made up Malayalam words such as Melcow!
- sundvor 9y agocs91PvMVtET37V%eKEMut0LI^kQYp3e&jSuCGl!9Lp Lastpass.
- hunter2_ 9y agoAll I see are asterisks, weird.
- sundvor 9y agoOh. I just grabbed what would have been my next random 42 character password, hoping that would be sufficient to prove the point that (almost) ridiculously long one time use passwords is the way to go.
- firebones 9y agoBravo. Masterclass username for this comment. I'm dying. (For those who may have missed it in this HN crowd, let me momentarily invoke a veil of joke-explainer and offer this http://knowyourmeme.com/memes/hunter2 http://knowyourmeme.com/memes/hunter2 of the joke.)
- sundvor 9y agoHaha, I've been around for a while but that one I missed. Awesome.
- pjmlp 9y agoWe can, just need to take responsability serious like in other fields. Software bugs should be no less than product defects, with possible fines in place.
- hemancuso 9y agoThis was particularly effective because the app was registered as "Google Docs" - to not even filter names of your own products out seems ripe picking for imposter apps.
- cortesoft 9y agoWas it actually called "Google Docs", or was it a homograph? https://en.wikipedia.org/wiki/IDN_homograph_attack https://en.wikipedia.org/wiki/IDN_homograph_attack
- tlogan 9y agoNah... they can just say "Free unsubscribe service" or "Free <whatever>". And people will click like crazy. And you can make actually make VC fundable business using that technique.
- cmg 9y agoI've seen this point and agree with it, but I really have to wonder: if the app was just called "Documents" or "My Docs" and had a professional-looking icon, would a significant number of people really have given it a second look anyway?
- bastih 9y agoIt was "Google Docs"
- cmg 9y agoI understand that - my question is whether the name is actually a factor that contributed to the spread. As AfroThundr said above, people just want to get to their content and want the dialog to go away. A known contact sends you a document - you're going to trust that and want to see the document. Unless it said the app name was "I'm going to hack your bank account" they'll probably click it (and even then, some would go for it anyway.)
- Raphmedia 9y ago
- ademarre 9y agoTo be clear, I'm not criticizing Google. Just presenting an interesting piece of information that shows the approach they've taken on this type of phishing attack in the past. Phishing is a hard problem, and any technical solution will only go so far. The main criticism I have with many OAuth authorization dialogs, not just Google's, is that they often don't show enough information for technical users to vet the authenticity of the app. It's like if a web browser didn't show the address bar.