5 ms·

Reads for me like making trouble out of nothing. Maybee I overread anything, but in general a Man-in-the-Middle is everytime possible when the user is not able

Reads for me like making trouble out of nothing. Maybee I overread anything, but in general a Man-in-the-Middle is everytime possible when the user is not able to check if his communication partner is trustworthy. The 'Analysis of impact' only bespokes the probability, but not what can happen and what besides of vandalism can be done with a login. And which goal a attacker could have that is valuable enough to justify the effort. Maybee nothing? The mitigations beside 'Short term - for users' are all reading for me like bullshit. Displaying the URL in the App will not change anything, when the user didn't understand what he see in the browser, why should he understand it in the app? Clearly, with a private/public key infrastructure, this could be fixed, but unrolling a thing expensive like this is questionable for a simple Man-in-the-Middle attack with this little impact.

Niksko 4y ago
Sure, the mitigation isn't perfect. But I think the wider point is that as usual, the Australian government have implemented a shit scheme, full of obvious and rookie mistakes, when they should have just used a well known open standard. Spelling out the very simple flaw is a means of underlining how poor this system is.
- krater23 4y ago
  Reads like you know more than I. They use (more) than the state of the art security of Amazon, eBay, Facebook, Steam, Paypal and so on. Is the impact bigger than the impact that can happen on this platforms? And if yes, what is it? Which impact can happen on Amazon, eBay, Steam? An attacker can steal your account and some hundreds of dollar of your money.
  - danielheath 4y ago
    I wasn't aware of steam/amazon/ebay acting as an identity provider to login to other websites.
    - gallexme 4y ago
      https://steamdb.info/login/ https://steamdb.info/login/ Steam does, Amazon I don't think so (just a pay via Amazon button I think)
- technion 4y ago
  I'm not convinced a well known standard would be any better against what basically comes down to "users might get phished". OAuth phishing against Microsoft accounts is a massive thing, I'm seeing it just as much as password phishing these days. It's regularly successful.
  - wzdd 4y ago
    "Users might get phished" is not a binary. Some people will always get phished. However the more obvious that you make it that you're getting phished, the fewer people will get phished. The current scheme apparently does not make it very obvious that you're being phished.
    - tialaramex 4y ago
      > Some people will always get phished https://krebsonsecurity.com/2018/07/google-security-keys-neutralized-employee-phishing/ https://krebsonsecurity.com/2018/07/google-security-keys-neu... Use WebAuthn. It is technically possible that your users are like "Well, the nice man needed my unique physical authenticator, so he sent a bike courier and I handed it over" but in practice that doesn't happen.
  - nomilk 4y ago
    The authors point out: > In the short term, the easy mitigation is to update the (phone) app to tell users where they're logging into. https://www.youtube.com/watch?v=TgPdVbUbtBM&t=4m25s https://www.youtube.com/watch?v=TgPdVbUbtBM&t=4m25s

Niksko 4y ago

Sure, the mitigation isn't perfect. But I think the wider point is that as usual, the Australian government have implemented a shit scheme, full of obvious and rookie mistakes, when they should have just used a well known open standard. Spelling out the very simple flaw is a means of underlining how poor this system is.

krater23 4y ago
Reads like you know more than I. They use (more) than the state of the art security of Amazon, eBay, Facebook, Steam, Paypal and so on. Is the impact bigger than the impact that can happen on this platforms? And if yes, what is it? Which impact can happen on Amazon, eBay, Steam? An attacker can steal your account and some hundreds of dollar of your money.
- danielheath 4y ago
  I wasn't aware of steam/amazon/ebay acting as an identity provider to login to other websites.
  - gallexme 4y ago
    https://steamdb.info/login/ https://steamdb.info/login/ Steam does, Amazon I don't think so (just a pay via Amazon button I think)
technion 4y ago
I'm not convinced a well known standard would be any better against what basically comes down to "users might get phished". OAuth phishing against Microsoft accounts is a massive thing, I'm seeing it just as much as password phishing these days. It's regularly successful.
- wzdd 4y ago
  "Users might get phished" is not a binary. Some people will always get phished. However the more obvious that you make it that you're getting phished, the fewer people will get phished. The current scheme apparently does not make it very obvious that you're being phished.
  - tialaramex 4y ago
    > Some people will always get phished https://krebsonsecurity.com/2018/07/google-security-keys-neutralized-employee-phishing/ https://krebsonsecurity.com/2018/07/google-security-keys-neu... Use WebAuthn. It is technically possible that your users are like "Well, the nice man needed my unique physical authenticator, so he sent a bike courier and I handed it over" but in practice that doesn't happen.
- nomilk 4y ago
  The authors point out: > In the short term, the easy mitigation is to update the (phone) app to tell users where they're logging into. https://www.youtube.com/watch?v=TgPdVbUbtBM&t=4m25s https://www.youtube.com/watch?v=TgPdVbUbtBM&t=4m25s