3 ms·
Why go thru all that trouble when you can just phish with malware? I’m reminded of back when Kevin Mitnick said it wasn’t that he was a great hacker, but that
by MR4D 7y ago
Why go thru all that trouble when you can just phish with malware?
I’m reminded of back when Kevin Mitnick said it wasn’t that he was a great hacker, but that he was good as social engineering. What made him good was that he took the easiest way in, which is kind of what my point is. I don’t care if you block the hardest hack - I care about blocking the easiest.
(FWIW, I am a huge fan of 2FA, I just don’t understand how it stops phishing.)
- dasil003 7y agoYou're moving the goalposts. GP was just explaining why base level phishing has been elevated to a higher difficulty level than without U2F. The way U2F prevents phishing is by binding auth requests to the requesting origin and generating unique key pairs for each origin, so it doesn't matter if the user is convinced and manually activates the key, the phishing site gains nothing it can use on a different origin—even in real time.
- MR4D 7y agoThank you. Indeed I was missing that - your last sentence in particular.
- jjoonathan 7y ago> I don’t care if you block the hardest hack - I care about blocking the easiest. My entire argument was "with U2F, this is the easiest hack, and it is very hard." What do you think the easier alternative was?