4 ms·
> That’s where older, weaker forms of MFA come in. They include one-time passwords sent through SMS or generated by mobile apps like Google Authenticator That
by TheDudeMan 5y ago
> That’s where older, weaker forms of MFA come in. They include one-time passwords sent through SMS or generated by mobile apps like Google Authenticator
That reference to Google Authenticator being weaker is not consistent with the rest of the article.
- tgsovlerkhgsel 5y agoAll of the OTP-based MFA methods are phishable, the phisher just has to bother enough to relay the stolen credential immediately.
- TheDudeMan 5y agoSeems like a much higher barrier than clicking a single button that is in your face.
- eli 5y agoNot really. There are ready to use phishing scripts that collect a TOTP and instantly relay it to the auto server
- TheDudeMan 5y agoThis article is not about phishing scripts.
- fomine3 5y agoAnyway what 2FA method is MITM--style-phishing-proof?
- tgsovlerkhgsel 5y agoU2F/FIDO/WebAuthN security keys.
- pornel 5y agoIt is, but only a little. It's still vulnerable to MITM, phishing websites, and fake support calls. OTOH hardware keys are much more foolproof. It's insufficient to merely ask victim to press a button. To bypass them you need to pwn the OS (not impossible, but harder than social engineering) or have physical access to victim's key (requires leaving mom's basement).
- lolinder 5y agoGenuinely curious: how is a hardware key invulnerable to a phishing website? Don't they just act as a keyboard to type in the OTP automatically? What stops a MITM from relaying it on?
- tgsovlerkhgsel 5y agoSome of them do, and they're obviously just as insecure. The ones implementing U2F/FIDO/WebAuthN or whatever the standard is called today will sign a cryptographic challenge, and the response includes the origin on which it was requested (i.e. the legit website will reject the response because the origin is the phishing site).
- tialaramex 5y agoTo expand on what the other reply said about FIDO authentication/ WebAuthn Security Keys (there are a lot of names for related technologies including U2F which was the predecessor technology), WebAuthn recruits the web browser to solve the phishing problem. The web browser definitely knows which DNS name this site has, because it's mechanically necessary in order to fetch web pages from it. So while the user may be confused and believe this is their bank, the browser is quite clear this is fakebank.phishing.example. Then WebAuthn has the browser tell the hardware token which site we're authenticating against, and the authentication credentials are distinct for every possible site. There are a few more wrinkles to make even it even better, but this is already enough that it's utterly pointless to try to phish Security Keys.