6 ms·
Clever, but it's tough to imagine that anyone savvy enough to use 2FA will be fooled by this.
by jaywalk 5y ago
Clever, but it's tough to imagine that anyone savvy enough to use 2FA will be fooled by this.
- ghostly_s 5y agoReally? If nothing looks phishy, few people are rigorous about inspecting URLs. Tech co's habits of using cryptic CDN domains and the like makes this hard behavior to change... login.google.goog-233.com ? hmm, guess they're doing some new clever thing I don't understand...oh well, I have things to do...
- __del__ 5y agogoog-233.com still fails the domain name test i taught my mom in 1999.
- edm0nd 5y agoeh, accounts with 2FA get phished and popped all the time. Users will always be the weakest link.
- daxelrod 5y agoSome people use 2FA because the service they're accessing requires it. Some people use 2FA for work accounts because their employer requires it. Using 2FA doesn't necessarily indicate savvy on the part of the user.
- tialaramex 5y agoMost people are using 2FA either because it was mandated (e.g. most of the systems at work have mandatory 2FA) or because they were strongly urged to use 2FA even though they don't really care. The problem here, as with all phishing, is that humans are easily fooled. But machines aren't fooled about this at all. Just have the machines make this critical decision and the problem evaporates, use WebAuthn to do 2FA. This makes life easier for humans because it is no longer their responsibility to try to figure out if they're being phished, WebAuthn solves that, back to my game of Wordle.