3 ms·

How else would you define a phishing attack than getting "access to the user's account" ???

• olliej 4y ago
  Given the comment I was replying to that was considering "access to the user's account" being the unlikely case, it seemed reasonable to go into very clear detail on what the real world attack vector is. That said, phishing does not necessarily mean gaining access to an account. The typical path is the low cost "trick someone into providing their credentials to a malicious party" - something browser based password managers do well, as they are very careful in ensuring they only ever enter passwords into the correct domain. You can also phish someone who is very careful by not asking for their account credentials, but having them do something innocuous that compromises their machine. For example you can have a fake company interview them and provide them a PDF with the job offer, and then have the PDF install malware. But the important thing is that the primary attack vector for any device is remote access. So things like disk encryption don't matter, and things like password notebooks are not accessible. The real problem is that once you have malware running on your machine, the presumption is that malware interested in credentials is going to elevate itself to super user at least and so generally gain code injection abilities in most processes that it could be interested in (e.g. all the password managers, or the system pasteboard, or whatever mechanism whichever the target password manager uses). Modern protections such as aggressive code-signing enforcement, sandboxing, SIP (or the windows equivalent), etc make such compromises harder, but harder != impossible.