3 ms·
As with sibling comment, what threat vector do you see phishing risk with? A race condition where the phishing email lands first, user clicks link to g00gle.co
by SgtBastard 3y ago
As with sibling comment, what threat vector do you see phishing risk with?
A race condition where the phishing email lands first, user clicks link to g00gle.com, gets a convincing message that they also need to present username and password?
- apitman 3y agoSee response to sibling
- SgtBastard 3y agoThank you - as sibling also mentioned, what you're describing in isn't a magic link but a standard TOTP/HOTP delivered via email which absolutely is phishable in the manner you described. Magic link is a process where you enter your email address and the service sends you an email that contains a clickable hyperlink that contains a cryptographically strong, short-lived nonce in the URI that is used as a proof-of-possession factor (the email account) to authenticate users.
- apitman 3y agoSee third cousin
- deleted 3y ago[deleted]
- andygeorge 3y agolooks like you replied to the wrong comment