4 ms·

Can you help me understand how those relate to each other? For instance, someone gets a malicious email, and clicks on a link which downloads a bit of code the

by MR4D 7y ago

Can you help me understand how those relate to each other? For instance, someone gets a malicious email, and clicks on a link which downloads a bit of code the exploits a bug in the software to install something, perhaps a key logger or screen reader. What on earth does hardware keys do to eliminate that? Seriously, I can’t make the connection (and if I understood I’d probably roll that out across my firm tomorrow!).

verdverm 7y ago
I phished for your login credentials, and I get them, but there is no way for me to effectively use them because there is still the hardware key step, which I do not have. Malware downloads is a separate issue from phishing schemes.
- jjoonathan 7y ago
  Right, and even if they completely root an employee's laptop and phone they still can't get into the hardware key. Sure, they can "boop hijack" the key by popping up a convincing fake login prompt, but they have to synchronize their schedule to the employee they want to hijack and pull off a convincing fake login prompt each and every time they want to login, so the logistics are still much more challenging than copying a OTP seed.
  - MR4D 7y ago
    Why go thru all that trouble when you can just phish with malware? I’m reminded of back when Kevin Mitnick said it wasn’t that he was a great hacker, but that he was good as social engineering. What made him good was that he took the easiest way in, which is kind of what my point is. I don’t care if you block the hardest hack - I care about blocking the easiest. (FWIW, I am a huge fan of 2FA, I just don’t understand how it stops phishing.)
    - dasil003 7y ago
      You're moving the goalposts. GP was just explaining why base level phishing has been elevated to a higher difficulty level than without U2F. The way U2F prevents phishing is by binding auth requests to the requesting origin and generating unique key pairs for each origin, so it doesn't matter if the user is convinced and manually activates the key, the phishing site gains nothing it can use on a different origin—even in real time.
      - MR4D 7y ago
        Thank you. Indeed I was missing that - your last sentence in particular.
    - jjoonathan 7y ago
      > I don’t care if you block the hardest hack - I care about blocking the easiest. My entire argument was "with U2F, this is the easiest hack, and it is very hard." What do you think the easier alternative was?
Thorrez 7y ago
The word "phishing" has many definitions. One definition is tricking users into giving valuable information (such as passwords, 2FA codes, bank account details, credit card numbers, social security numbers, etc). Malware doesn't meet this definition of phishing.

by MR4D 7y ago

verdverm 7y ago

I phished for your login credentials, and I get them, but there is no way for me to effectively use them because there is still the hardware key step, which I do not have. Malware downloads is a separate issue from phishing schemes.

jjoonathan 7y ago
Right, and even if they completely root an employee's laptop and phone they still can't get into the hardware key. Sure, they can "boop hijack" the key by popping up a convincing fake login prompt, but they have to synchronize their schedule to the employee they want to hijack and pull off a convincing fake login prompt each and every time they want to login, so the logistics are still much more challenging than copying a OTP seed.
- MR4D 7y ago
  Why go thru all that trouble when you can just phish with malware? I’m reminded of back when Kevin Mitnick said it wasn’t that he was a great hacker, but that he was good as social engineering. What made him good was that he took the easiest way in, which is kind of what my point is. I don’t care if you block the hardest hack - I care about blocking the easiest. (FWIW, I am a huge fan of 2FA, I just don’t understand how it stops phishing.)
  - dasil003 7y ago
    You're moving the goalposts. GP was just explaining why base level phishing has been elevated to a higher difficulty level than without U2F. The way U2F prevents phishing is by binding auth requests to the requesting origin and generating unique key pairs for each origin, so it doesn't matter if the user is convinced and manually activates the key, the phishing site gains nothing it can use on a different origin—even in real time.
    - MR4D 7y ago
      Thank you. Indeed I was missing that - your last sentence in particular.
  - jjoonathan 7y ago
    > I don’t care if you block the hardest hack - I care about blocking the easiest. My entire argument was "with U2F, this is the easiest hack, and it is very hard." What do you think the easier alternative was?

Thorrez 7y ago

The word "phishing" has many definitions. One definition is tricking users into giving valuable information (such as passwords, 2FA codes, bank account details, credit card numbers, social security numbers, etc). Malware doesn't meet this definition of phishing.