3 ms·
Surely an attacker can just proxy this? Seems like security theatre to me.
by Nextgrid 5y ago
Surely an attacker can just proxy this? Seems like security theatre to me.
- motoboi 5y agoThis is for phishing attacks with lookalike domains and sites. Pretty common in the web banking world.
- Nextgrid 5y agoYes but I'm pretty sure the lookalike domain proxy your username and the "security picture" back to the real domain to make it look legitimate.
- tialaramex 5y agoThe software to do it is even available on GitHub IIRC. Purely for research purposes of course. We know how to actually fix this, apparently people don't want to :(
- jakub_g 5y agoYep. This is kinda useful as an indicator whether you wrote login correctly (wrong pic = wrong login) and to weed out the lowest quality phishing, but for anyone who's not a clown it should be easy to recreate the flow and hence, it's actually even harmful (you think you get assurance you're not scammed while getting scammed). Edit: one thing to make it more bulletproof would be bank rejecting all calls that look like serverish initiated (AWS etc), then the attacker would need some genuinely looking botnet to not get blocked by the bank due to suspicious volume from same IP pool. Raises the bar for attack, but still, serious attacker can mitigate this.
- aaronharnly 5y agoThey only show the picture after you have logged in successfully from the device. If it is a new device (or attacker), the picture is blank and the site says something like “first time using this device?” So it helps against phishing or a MITM that doesn’t intercept the real site cookies.
- banana_giraffe 5y agoGenerally the attack vector is much easier: Just replace the image with a "This service is currently being upgraded for your safety!" or whatever. Most people in studies I've seen will still go through with the login.