3 ms·

I'm not convinced a well known standard would be any better against what basically comes down to "users might get phished". OAuth phishing against Microsoft acc

I'm not convinced a well known standard would be any better against what basically comes down to "users might get phished". OAuth phishing against Microsoft accounts is a massive thing, I'm seeing it just as much as password phishing these days. It's regularly successful.

wzdd 4y ago
"Users might get phished" is not a binary. Some people will always get phished. However the more obvious that you make it that you're getting phished, the fewer people will get phished. The current scheme apparently does not make it very obvious that you're being phished.
- tialaramex 4y ago
  > Some people will always get phished https://krebsonsecurity.com/2018/07/google-security-keys-neutralized-employee-phishing/ https://krebsonsecurity.com/2018/07/google-security-keys-neu... Use WebAuthn. It is technically possible that your users are like "Well, the nice man needed my unique physical authenticator, so he sent a bike courier and I handed it over" but in practice that doesn't happen.
nomilk 4y ago
The authors point out: > In the short term, the easy mitigation is to update the (phone) app to tell users where they're logging into. https://www.youtube.com/watch?v=TgPdVbUbtBM&t=4m25s https://www.youtube.com/watch?v=TgPdVbUbtBM&t=4m25s