4 ms·

Some third party detects you're trying to sign into a website. The third party sends you an email, that email happens to arrive first. You click the link in the

Some third party detects you're trying to sign into a website. The third party sends you an email, that email happens to arrive first. You click the link in the email. Now you're on a website that looks like the one you expected (if the third party has done its homework) but is completely in control by the third party. Apparently things like this do happen, for example when people are buying or selling things on the internet. They get redirected to a pay processing site that looks just like the one from their bank, but steals their money and/or identity instead.

daveoc64 4y ago
I'm not sure what actual security risk you're talking about here. I click the magic link, expecting it to sign me in, but instead it takes me to a fake copy of the website which then asks (again) for login details?
- OJFord 4y ago
  Yes, a lot of people will fall for that.
- pritambaral 4y ago
  > but instead it takes me to a fake copy of the website ... This is fine, but ... > ... which then asks (again) for login details? This is where the trick lies. The third-party copy doesn't have to ask you for login details. As your parent states: They get redirected to a pay processing site that looks just like the one from their bank, but steals their money and/or identity instead. The fake site doesn't have to show you details of your account. It has to look just similar enough that enough people will think it's a legit payment site and submit their payment details. ---- There's also a simpler, alternative attack I mention in a sibling comment: https://news.ycombinator.com/item?id=32081724 https://news.ycombinator.com/item?id=32081724
pritambaral 4y ago
> Now you're on a website that looks like the one you expected (if the third party has done its homework) but is completely in control by the third party. A simpler attack would be to for the third-party attempt a login on their end into your account, and if you happen to click on the Magic Link generated by their login attempt, you wouldn't be signing yourself in, but them.
rambambram 4y ago
> Some third party detects you're trying to sign into a website. And this third party can find out how, exactly?
- ben_w 4y ago
  Off the top of my head, even in HTTPS the domain name isn't encrypted, which may be enough to make a good guess. Or possibly just guessing without evidence because the sending cost of junk email is so low — looking at my junk mail folders, I have reason to believe they guess. FWIW, I've heard of this type of attack (deliberately timed) being used during house purchases, with a fake destination bank message preceding the real message by a few minutes. Does anyone know if that's real or just an urban legend?
  - rambambram 4y ago
    Ah, like that you mean. Thanks. I was thinking of embedded third party code on a website (which might better not be included on sensitive pages).

daveoc64 4y ago

I'm not sure what actual security risk you're talking about here. I click the magic link, expecting it to sign me in, but instead it takes me to a fake copy of the website which then asks (again) for login details?

OJFord 4y ago
Yes, a lot of people will fall for that.
pritambaral 4y ago
> but instead it takes me to a fake copy of the website ... This is fine, but ... > ... which then asks (again) for login details? This is where the trick lies. The third-party copy doesn't have to ask you for login details. As your parent states: They get redirected to a pay processing site that looks just like the one from their bank, but steals their money and/or identity instead. The fake site doesn't have to show you details of your account. It has to look just similar enough that enough people will think it's a legit payment site and submit their payment details. ---- There's also a simpler, alternative attack I mention in a sibling comment: https://news.ycombinator.com/item?id=32081724 https://news.ycombinator.com/item?id=32081724

pritambaral 4y ago

> Now you're on a website that looks like the one you expected (if the third party has done its homework) but is completely in control by the third party. A simpler attack would be to for the third-party attempt a login on their end into your account, and if you happen to click on the Magic Link generated by their login attempt, you wouldn't be signing yourself in, but them.

rambambram 4y ago

> Some third party detects you're trying to sign into a website. And this third party can find out how, exactly?

ben_w 4y ago
Off the top of my head, even in HTTPS the domain name isn't encrypted, which may be enough to make a good guess. Or possibly just guessing without evidence because the sending cost of junk email is so low — looking at my junk mail folders, I have reason to believe they guess. FWIW, I've heard of this type of attack (deliberately timed) being used during house purchases, with a fake destination bank message preceding the real message by a few minutes. Does anyone know if that's real or just an urban legend?
- rambambram 4y ago
  Ah, like that you mean. Thanks. I was thinking of embedded third party code on a website (which might better not be included on sensitive pages).