3 ms·

My understanding of the text is that 10 of 50 actually entered credentials. So the 1/5th is really the number of people who a phisher would've stolen credential

by hannob 6y ago

My understanding of the text is that 10 of 50 actually entered credentials. So the 1/5th is really the number of people who a phisher would've stolen credentials (although they say later they use 2fa which would've prevented a real attack, but still bad enough, as you can expect these people use other accounts which may not even support 2fa).

oefrha 6y ago
2FA (assuming TOTP, not hardware keys) prevents attacks using credentials leaked from side channels, but does not work in phishing attacks using a fake login form. The attacker just needs to channel the TOTP you entered into the real login form, and on average they have a bit more than 15 seconds to do so, which is more than enough.
- datguacdoh 6y ago
  This is what makes security keys so great, you can't surreal a token from one domain and use it on another. They completely remove this type of attack, which no amount of training will ever fully protect you from. You can't put the onus on the employee, you have to make it impossible for them to do the wrong thing in this case.
  - oefrha 6y ago
    Any password manager with browser integration can make sure you don’t fill in credentials on the wrong domain. No need for additional hardware.
    - munchbunny 6y ago
      That just stops you from automatically entering the password. A security key will literally not authenticate in that situation. Defense in depth is just as much of a thing for personal security as network security.
      - guerby 6y ago
        Something I'm curious about 2FA with security keys: why are we entering login then password then click 2FA instead of doing login then 2FA then password ? It seems it would add a layer protection to the weak link which is the password. Any idea?
        tialaramex 6y ago
        An idea: Most sites, certainly consumer sites, which offer WebAuthn it's very optional. So doing it the current way just adds a step after the password step. You need a (perhaps stolen) password to even find out there's a next step and you're not in after all. But if we swap it, now we're telling bad guys if this account is protected up front. "This one is WebAuthn, forget it, same for the next one, aha, this one asks for a password, let's target that". The people with WebAuthn are no worse off that before, maybe even arguably better in terms of password re-use - but everybody else gives away that they aren't protected.

by hannob 6y ago

oefrha 6y ago

2FA (assuming TOTP, not hardware keys) prevents attacks using credentials leaked from side channels, but does not work in phishing attacks using a fake login form. The attacker just needs to channel the TOTP you entered into the real login form, and on average they have a bit more than 15 seconds to do so, which is more than enough.

datguacdoh 6y ago
This is what makes security keys so great, you can't surreal a token from one domain and use it on another. They completely remove this type of attack, which no amount of training will ever fully protect you from. You can't put the onus on the employee, you have to make it impossible for them to do the wrong thing in this case.
- oefrha 6y ago
  Any password manager with browser integration can make sure you don’t fill in credentials on the wrong domain. No need for additional hardware.
  - munchbunny 6y ago
    That just stops you from automatically entering the password. A security key will literally not authenticate in that situation. Defense in depth is just as much of a thing for personal security as network security.
    - guerby 6y ago
      Something I'm curious about 2FA with security keys: why are we entering login then password then click 2FA instead of doing login then 2FA then password ? It seems it would add a layer protection to the weak link which is the password. Any idea?
      - tialaramex 6y ago
        An idea: Most sites, certainly consumer sites, which offer WebAuthn it's very optional. So doing it the current way just adds a step after the password step. You need a (perhaps stolen) password to even find out there's a next step and you're not in after all. But if we swap it, now we're telling bad guys if this account is protected up front. "This one is WebAuthn, forget it, same for the next one, aha, this one asks for a password, let's target that". The people with WebAuthn are no worse off that before, maybe even arguably better in terms of password re-use - but everybody else gives away that they aren't protected.