4 ms·
Agree this is excellent, and demonstrates how straightforward phishing really is. 2FA wouldn't save you here either, as that can easily be phished at the same t
by albertgoeswoof 9y ago
Agree this is excellent, and demonstrates how straightforward phishing really is. 2FA wouldn't save you here either, as that can easily be phished at the same time (except for U2F tokens).
- jethro_tell 9y agoright the point of u2f is the physical token
- albertgoeswoof 9y agoSort of - the point of u2f is challenge-response on the key, which is tied to the URI or https session, which makes it impossible to phish without a browser exploit
- vertex-four 9y agoThe "point" of U2F instead of HOTP/TOTP is that the code you send to evilhacker.com can't be used on google.com - so getting a usable token by phishing is impossible. HOTP/TOTP are flawed in that you can send the generated code to evilhacker.com and they can use it to log in to google.com with you being none the wiser.
- EGreg 9y agoHow would you phish 2FA "at the same time"?
- albertgoeswoof 9y agoYou ask for the token as well and login with it at the same time. It'll trip you up later if it asks again (e.g. When changing a password or setting up mail forwarding) but your session cookie will be valid for quite some time.