3 ms·
If Google has an internal offensive pen test team, I assume they would likely disagree with that statement, esp. since Chrome allowed (maybe still allows?) to r
by kerng 8y ago
If Google has an internal offensive pen test team, I assume they would likely disagree with that statement, esp. since Chrome allowed (maybe still allows?) to read Yubikey info via WebUSB for instance - only one click in UI that was the mitigation.
If Google would authorize external hackers (eg via bug bounty), it probably would take about 2-4 hours to phish an account successfully. :)
- kyrra 8y agoI believe this is the key quote: “We have had no reported or confirmed account takeovers since implementing security keys at Google,” Security keys basically remove the account takeover path, but there are still many other types of phishing attacks out that are still effective.
- 0xFFFF0000 8y agoThe WebUSB angle is interesting - hadn't thought about that. I remember hearing about this during a Chaos Communication Congress talk last December. It only required one wrong click from a Chrome user to authorize exposure.