3 ms·
"Users might get phished" is not a binary. Some people will always get phished. However the more obvious that you make it that you're getting phished, the fewer
by wzdd 4y ago
"Users might get phished" is not a binary. Some people will always get phished. However the more obvious that you make it that you're getting phished, the fewer people will get phished.
The current scheme apparently does not make it very obvious that you're being phished.
- tialaramex 4y ago> Some people will always get phished https://krebsonsecurity.com/2018/07/google-security-keys-neutralized-employee-phishing/ https://krebsonsecurity.com/2018/07/google-security-keys-neu... Use WebAuthn. It is technically possible that your users are like "Well, the nice man needed my unique physical authenticator, so he sent a bike courier and I handed it over" but in practice that doesn't happen.