4 ms·

Why would Duo Push allow Mallory's site to initiate a Duo Push for RealSite.com without either a shared secret or certificate validation? You present an obviou

• paranoidrobot 8y ago
  Because mallory.com (who's impersonating valery.com by ripping off the site design, and has a valid certificate for mallory.com) is running a full-up copy of Chrome in a VM, and is clicking the signin link just like a user would do. I assume what Duo is referring to, though, is that they send through the IP address that your push request is coming from. So if a user is observant and knows their public IP, they should see the difference.
• tialaramex 8y ago
  The real site doesn't know this is Mallory, after all Mallory has the victim's credentials. It stands to reason it will offer Duo Push. And the victim is expecting Duo Push so they'll hit OK. You insist this "has been solved securely many times over" but it famously hasn't, which is why I asked if Duo had some secret sauce. They evidently don't. People keep building things that are very clever but don't actually respond to the threats in the real world, MITM is a real world threat, and one Duo shouldn't be pretending they're defending against with this Push technology.