3 ms·

Sure, the mitigation isn't perfect. But I think the wider point is that as usual, the Australian government have implemented a shit scheme, full of obvious and

by Niksko 4y ago

Sure, the mitigation isn't perfect. But I think the wider point is that as usual, the Australian government have implemented a shit scheme, full of obvious and rookie mistakes, when they should have just used a well known open standard. Spelling out the very simple flaw is a means of underlining how poor this system is.

krater23 4y ago
Reads like you know more than I. They use (more) than the state of the art security of Amazon, eBay, Facebook, Steam, Paypal and so on. Is the impact bigger than the impact that can happen on this platforms? And if yes, what is it? Which impact can happen on Amazon, eBay, Steam? An attacker can steal your account and some hundreds of dollar of your money.
- danielheath 4y ago
  I wasn't aware of steam/amazon/ebay acting as an identity provider to login to other websites.
  - gallexme 4y ago
    https://steamdb.info/login/ https://steamdb.info/login/ Steam does, Amazon I don't think so (just a pay via Amazon button I think)
technion 4y ago
I'm not convinced a well known standard would be any better against what basically comes down to "users might get phished". OAuth phishing against Microsoft accounts is a massive thing, I'm seeing it just as much as password phishing these days. It's regularly successful.
- wzdd 4y ago
  "Users might get phished" is not a binary. Some people will always get phished. However the more obvious that you make it that you're getting phished, the fewer people will get phished. The current scheme apparently does not make it very obvious that you're being phished.
  - tialaramex 4y ago
    > Some people will always get phished https://krebsonsecurity.com/2018/07/google-security-keys-neutralized-employee-phishing/ https://krebsonsecurity.com/2018/07/google-security-keys-neu... Use WebAuthn. It is technically possible that your users are like "Well, the nice man needed my unique physical authenticator, so he sent a bike courier and I handed it over" but in practice that doesn't happen.
- nomilk 4y ago
  The authors point out: > In the short term, the easy mitigation is to update the (phone) app to tell users where they're logging into. https://www.youtube.com/watch?v=TgPdVbUbtBM&t=4m25s https://www.youtube.com/watch?v=TgPdVbUbtBM&t=4m25s

by Niksko 4y ago

krater23 4y ago

Reads like you know more than I. They use (more) than the state of the art security of Amazon, eBay, Facebook, Steam, Paypal and so on. Is the impact bigger than the impact that can happen on this platforms? And if yes, what is it? Which impact can happen on Amazon, eBay, Steam? An attacker can steal your account and some hundreds of dollar of your money.

danielheath 4y ago
I wasn't aware of steam/amazon/ebay acting as an identity provider to login to other websites.
- gallexme 4y ago
  https://steamdb.info/login/ https://steamdb.info/login/ Steam does, Amazon I don't think so (just a pay via Amazon button I think)

technion 4y ago

I'm not convinced a well known standard would be any better against what basically comes down to "users might get phished". OAuth phishing against Microsoft accounts is a massive thing, I'm seeing it just as much as password phishing these days. It's regularly successful.

wzdd 4y ago
"Users might get phished" is not a binary. Some people will always get phished. However the more obvious that you make it that you're getting phished, the fewer people will get phished. The current scheme apparently does not make it very obvious that you're being phished.
- tialaramex 4y ago
  > Some people will always get phished https://krebsonsecurity.com/2018/07/google-security-keys-neutralized-employee-phishing/ https://krebsonsecurity.com/2018/07/google-security-keys-neu... Use WebAuthn. It is technically possible that your users are like "Well, the nice man needed my unique physical authenticator, so he sent a bike courier and I handed it over" but in practice that doesn't happen.
nomilk 4y ago
The authors point out: > In the short term, the easy mitigation is to update the (phone) app to tell users where they're logging into. https://www.youtube.com/watch?v=TgPdVbUbtBM&t=4m25s https://www.youtube.com/watch?v=TgPdVbUbtBM&t=4m25s