4 ms·

> U2F is the only method that protects against (2) Would you be able to elaborate on this? I'm not understanding the difference between TOTP and the physical k

> U2F is the only method that protects against (2) Would you be able to elaborate on this? I'm not understanding the difference between TOTP and the physical key from the article for this scenario.

toast0 8y ago
With TOTP, a sufficiently clever phish may convince you to enter the one time code. With U2F, there is communication between the browser and the device, requesting authentication for a specific origin hostname -- that can't (shouldn't) be fooled by a phish hosted at Google.com-super-secure-phishing.net
- tzs 8y ago
  Where do password managers fit in here? If a phisher convinces me to try to login to google.com-super-secure-phishing.net using my google account I'm going to notice something is wrong when my password manager refuses to fill in the login form.
  - SpaethCo 8y ago
    This is where it comes down to user behavior. One of the security engineers from Stripe gave a talk about this at Blackhat last year -- she had phishing campaigns that had users ignore that autofill didn't work and manually copied/pasted their password manager credentials into the phishing sites. https://www.youtube.com/watch?v=Z20XNp-luNA https://www.youtube.com/watch?v=Z20XNp-luNA
  - chimeracoder 8y ago
    > If a phisher convinces me to try to login to google.com-super-secure-phishing.net using my google account I'm going to notice something is wrong when my password manager refuses to fill in the login form. You say that, but the overwhelming body of evidence from real-life phishing attacks and red-team exercises demonstrates that even very technologically-literate engineers will not consistently notice.
- agildehaus 8y ago
  Google and Apple both have mobile (non-SMS) based two factor prompts that seem equally immune to phishing?
  - SpaethCo 8y ago
    > Google and Apple both have mobile (non-SMS) based two factor prompts that seem equally immune to phishing? Any "type in a code" or "approve this login (yes/no)?" authentication factor is technically vulnerable. All the phishing site needs to do is proxy the authentication to the actual site in real time. These guys put together a great overview of the approach: https://www.wandera.com/bypassing-2fa/ https://www.wandera.com/bypassing-2fa/
SmellyGeekBoy 8y ago
The current domain is sent to the device and used to generate a private key that is used to authenticate. If it's a phishing domain, the device will return a private key that won't work on the real domain.

> U2F is the only method that protects against (2) Would you be able to elaborate on this? I'm not understanding the difference between TOTP and the physical key from the article for this scenario.

toast0 8y ago

With TOTP, a sufficiently clever phish may convince you to enter the one time code. With U2F, there is communication between the browser and the device, requesting authentication for a specific origin hostname -- that can't (shouldn't) be fooled by a phish hosted at Google.com-super-secure-phishing.net

tzs 8y ago
Where do password managers fit in here? If a phisher convinces me to try to login to google.com-super-secure-phishing.net using my google account I'm going to notice something is wrong when my password manager refuses to fill in the login form.
- SpaethCo 8y ago
  This is where it comes down to user behavior. One of the security engineers from Stripe gave a talk about this at Blackhat last year -- she had phishing campaigns that had users ignore that autofill didn't work and manually copied/pasted their password manager credentials into the phishing sites. https://www.youtube.com/watch?v=Z20XNp-luNA https://www.youtube.com/watch?v=Z20XNp-luNA
- chimeracoder 8y ago
  > If a phisher convinces me to try to login to google.com-super-secure-phishing.net using my google account I'm going to notice something is wrong when my password manager refuses to fill in the login form. You say that, but the overwhelming body of evidence from real-life phishing attacks and red-team exercises demonstrates that even very technologically-literate engineers will not consistently notice.
agildehaus 8y ago
Google and Apple both have mobile (non-SMS) based two factor prompts that seem equally immune to phishing?
- SpaethCo 8y ago
  > Google and Apple both have mobile (non-SMS) based two factor prompts that seem equally immune to phishing? Any "type in a code" or "approve this login (yes/no)?" authentication factor is technically vulnerable. All the phishing site needs to do is proxy the authentication to the actual site in real time. These guys put together a great overview of the approach: https://www.wandera.com/bypassing-2fa/ https://www.wandera.com/bypassing-2fa/

SmellyGeekBoy 8y ago

The current domain is sent to the device and used to generate a private key that is used to authenticate. If it's a phishing domain, the device will return a private key that won't work on the real domain.