4 ms·
How does two-factor cut down on phishing again? Instead of a fake login page with 2 boxes, a phisher could just create a fake login page with 3 boxes and pass
by roc 16y ago
How does two-factor cut down on phishing again?
Instead of a fake login page with 2 boxes, a phisher could just create a fake login page with 3 boxes and pass the keycode along with everything else.
The only increased difficulty in phishing, is if the user notes they're seeing a keycode prompt, decides that they probably shouldn't have to enter that again and doesn't just key it in anyway.
When we're talking about people who fall for phishing scams, does that sound all that likely? I mean, these people have a history of ignoring red flags and being blissfully ignorant to what should even raise a red flag.
Now, what two-factor will help mitigate, is casual sniffing, keylogging, shoulder-surfing and saved password cracking.
- albertsun 16y agoThe keycode is unique to each log-in attempt.
- joshhepworth 16y agoWhile I have used this kind of authentication before, I'm not intimately familiar with it. From the way Kincaid described it in the article, it seems the key is unique only to a general moment in time, not each log-in attempt (though it wouldn't be hard to imagine it being invalidated as soon as it was used). If it is only a moment in time, I assume the phishing script could simply log in at the same time and hope the user has the "once per computer" setting enabled. Though this seems like too big of something to miss. Can anyone offer some clarification?
- roc 16y agoIs this a stand-alone fob-style system, where the keycode is unique to a point in time with no knowledge of the connection? Or is this some sort of second-channel verification, where the requesting connection is hashed into the one-time-pad?
- groby_b 16y agoBoth Paypal and WoW use standalone FOB, keycode unique to a point in time. Of course, paypal's "I lost my authenticator, log me in anyways" button is kind of defeating the purpose...
- roc 16y agoOk, but what is Google offering? Unless I'm missing something, RFC 4226 sounds like the RSA SecurID system I've worked with before; which is essentially equivalent to Blizzard's system for World of Warcraft. In which case, my criticism stands. It's trivially more difficult to phish a keycode and the limited window of opportunity is simply a non-issue.[1] Unless Google is calculating a one-time pad based on the individual login attempt and sending it along a second channel to the registered user, there'll be almost no reduction in phishing. [1] The tens of seconds a keycode is valid are more than enough to establish a connection.
- groby_b 16y agoWhich means you phished it once. Which means you need to take drastic actions to exploit it, a slow buildup over time is not an option. Which in turn means you're more likely to get detected. It's not full protection - you'd still need a second channel for that - but it's better than nothing.
- roc 16y agoIt is certainly better than nothing. I just took issue with the article's repeated insistence that it'd make phishing harder/impossible. It does many good things. That is not one of them.
- lutorm 16y agoFor the systems I log in to, each SecurID code is only valid once. If you want to log in again, you need to wait until a new code is available and use it.
- teejae 16y agoSee: http://en.wikipedia.org/wiki/HOTP http://en.wikipedia.org/wiki/HOTP and http://en.wikipedia.org/wiki/Time-based_One-time_Password_Algorithm http://en.wikipedia.org/wiki/Time-based_One-time_Password_Al... You can download the Google Authenticator app. These algorithms are known. You can implement it yourself if you wanted to.
- gregable 16y agoStand-alone where the keycode is unique to a point in time with no knowledge of the connection.
- MrFlibble 16y agoAs I understand it, you need a secure & clean initial set-up, after which the user should not have to enter a key again as the handshake between your machine and Google will automatically change. Phishing won't work if the user does not have to enter the key again. It requires a clean (no keylogger etc) initial setup. Once installed if someone phishes the end user wouldn't need to re-enter a key, thus defeating the phishing scheme.
- Shahukaar 16y agoIt is important to distinguish between active and passive attacks. The verification code generated is valid only for a very short time - so unless the hacker phishes the code, and uses it within 10s of seconds, the code is not valid.
- LordLandon 16y agoNothing's stopping the phishing site from going and logging in once the token's phished, and logging the cookie as opposed to just logging the password+token. And you get a lot more seconds if you log in within those 10 seconds.