4 ms·

I'd have though that two-factor authentication could have prevented this type of attack?

• zootboy 9y ago
  Not if the phising site asks for the 2FA token.
  • userbinator 9y ago
    The point of 2FA is challenge-response and the secret key is in the token. If a phishing site asks for 2FA it can get only one valid challenge-response pair, not the secret key.
    • deleted 9y ago
      [deleted]
    • joshuamorton 9y ago
      That still allows them to log in though.
    • Gaelan 9y ago
      One login is enough to authorize an Oauth app.
      • ReverseCold 9y ago
        Require second login to transfer chrome apps to alternate account + 24 hour timer on transfer that sends an email to recovery email/everyone else relevant when extension is transferring.
    • Buge 9y ago
      SMS and TOTP (Google Authenticator) can both be phished. U2F cannot be phished.
      • TeMPOraL 9y ago
        Can't it? What if I control the user's computer and can let my own code interact with U2F? Or does the protocol somehow prevent that?
        • deleted 9y ago
          [deleted]
        • Buge 9y ago
          If you control the user's computer, that isn't phishing. That's keylogging/credential theft.
• giovannibajo1 9y ago
  Only with U2F, because the hardware dongle would refuse to provide the OTP to a different domain
  • devrandomguy 9y ago
    Yeah, we really need to distinguish between a 2FA app and a dedicated hardware key. My phone is probably the least secure thing I've ever owned, both in terms of technical security, and physical security. This whole 2FA thing has been really jarring for me, because I always treated my phone like a public space: no password, no private data (that I know of), ready for inspection by foreign authorities. Of all the things the world could ask me to trust, why the phone?
    • Buge 9y ago
      Even a dedicated hardware key that generates an OTP[1] can still be phished. Only U2F cannot be phished. [1] https://en.wikipedia.org/wiki/Security_token#/media/File:CryptoCard_two_factor.jpg https://en.wikipedia.org/wiki/Security_token#/media/File:Cry...
    • TeMPOraL 9y ago
      > Of all the things the world could ask me to trust, why the phone? Because it's the only instance of a computer that you can expect majority of users to own and always have on them. 2FA as a thing would not get any reasonable adoption if you required people to buy hardware keys to use it. Not to mention, hardware keys do not work on every device one would like to log in from (AFAIK you can't plug in a Yubikey to an Android tablet, and it may not have NFC built in).
      • deleted 9y ago
        [deleted]
      • mschuster91 9y ago
        > AFAIK you can't plug in a Yubikey to an Android tablet, and it may not have NFC built in Using an USB OTG adapter, it should be possible. However, even the flagship tablets of Samsung don't carry NFC, only the phones do - and even there it's a hit and miss if you have NFC. Apple, on the other hand, doesn't have developer-accessible NFC anywhere. This is a real shame.
• CM30 9y ago
  It could, and the plugin creators regret not having it active for everyone's account: > Sigh... totally agree. I could add a longer story why just this account had no 2FA enabled, but the lesson learned is simple: From now on, we enable 2FA for every account that offers it. So they won't make this mistake again.
  • sgroppino 9y ago
    Thanks - saw it now in the comments.