5 ms·

>I don't understand what is meant by phishing-resistant By far the most common phish is "click this link or your account will be shut down" which brings you to

>I don't understand what is meant by phishing-resistant By far the most common phish is "click this link or your account will be shut down" which brings you to a fake Microsoft/Google sign-in page, where they say "please enter your credentials" (or some variant of this). This flavor of phishing is eliminated by passkeys. Phishing schemes will try to adapt, and some may still be successful. That is why it is not called "phishing-proof".

mecsred 2y ago
That's a particular scheme that might be fooled, but what's stopping someone from making a version of the same scheme that redirects to a prompt on the real site which authorizes them as a new user? I'll admit web technologies aren't my area of expertise but I have little doubt it's possible based on my interactions so far. E.g. discord allowing me to log in to a new device by scanning a QR code with my phone and clicking OK. Ultimately the point of phishing is to attack the user instead of the technology. If the user has any control over access to their account, phishing is largely unaffected.
- deleted 2y ago
  [deleted]
- nailer 2y ago
  >what's stopping someone from making a version of the same scheme that redirects to a prompt on the real site which authorizes them as a new user I can give a better answer than the sibling: The passkey is domain bound, so the UI won't show up on the phishing site before the passthrough can even happen. Password managers are also domain-bound though.
  - Terretta 2y ago
    > Password managers are also domain-bound though. are also --> can be Often they allow picking an entry for arbitrary domain names, made necessary by firms (such as Microsoft) randomizing their login domains to look like phishing domains.* * Not what they are doing, but to the casual user, logging into xbox.com, office.com, or even microsoft.com through something like microsoftonline.com may as well be phishing.
    - nailer 2y ago
      Agreed. Even a few hours ago I got something for w-m.com (!) which was actually genuinely sent by Walmart.
      - Cpoll 2y ago
        I wouldn't assume a 3-character .com is a phishing domain, they're hardly cheap and disposable. But I get your point, I've seen some suspicious (legitimate) alternate domains. Stuff like (not a real example) amazon-fulfillment.com.
        nailer 2y ago
        A dash in a domain though is pretty ratchet.
- samcat116 2y ago
  > what's stopping someone from making a version of the same scheme that redirects to a prompt on the real site which authorizes them as a new user? This would require compromising the website as a whole
- amscanne 2y ago
  You’re loosely describing a CSRF vulnerability, which do occur but people try to design against them and mitigate them. For example, actions that mutate often require POST (which won’t be triggered by a link), cookies may be marked strict (and not sent from frames or following links), etc.
Arnavion 2y ago
>This flavor of phishing is eliminated by passkeys. ... and also eliminated by password managers that use autofill based on the domain name.
- tptacek 2y ago
  No it isn't, because people will manually fill things in when autofill doesn't work. People will go out of their way to feed credentials to sites that look authentic; it's a genuinely hard problem. (I've had the displeasure of having to work on it for financial industry clients.)
  - GoblinSlayer 2y ago
    So, it's just a password manager that doesn't show you the password? With pwdhash it's difficult to fill things manually too.
  - lolinder 2y ago
    Can you elaborate (or provide a source that does) on how passkeys prevent a phisher from just MITMing the initial passkey setup with some nonsense claim about your session expiring? I'm probably mistaken here, but my interactions with passkeys always make them seem to be trust-on-first-use, which is a very phishable strategy.
    - samcat116 2y ago
      Passkeys are tied to a DNS name, so unless they were able to take over the DNS of a site, they wouldn't ever even be offered to authenticate the password. Additionally the private key never leaves the device regardless, so if you were tricked to setup a new passkey on a fake site, you'd just end up creating a new Passkey for it and the site would get some new unique public key.
      - bennettnate5 2y ago
        More than DNS name though--while DNS is susceptible to MITM and cache poisoning, afaik passkeys requires HTTPS so the domain's certificate is validated. Authentication not assertion and all that

mecsred 2y ago

That's a particular scheme that might be fooled, but what's stopping someone from making a version of the same scheme that redirects to a prompt on the real site which authorizes them as a new user? I'll admit web technologies aren't my area of expertise but I have little doubt it's possible based on my interactions so far. E.g. discord allowing me to log in to a new device by scanning a QR code with my phone and clicking OK. Ultimately the point of phishing is to attack the user instead of the technology. If the user has any control over access to their account, phishing is largely unaffected.

deleted 2y ago
[deleted]
nailer 2y ago
>what's stopping someone from making a version of the same scheme that redirects to a prompt on the real site which authorizes them as a new user I can give a better answer than the sibling: The passkey is domain bound, so the UI won't show up on the phishing site before the passthrough can even happen. Password managers are also domain-bound though.
- Terretta 2y ago
  > Password managers are also domain-bound though. are also --> can be Often they allow picking an entry for arbitrary domain names, made necessary by firms (such as Microsoft) randomizing their login domains to look like phishing domains.* * Not what they are doing, but to the casual user, logging into xbox.com, office.com, or even microsoft.com through something like microsoftonline.com may as well be phishing.
  - nailer 2y ago
    Agreed. Even a few hours ago I got something for w-m.com (!) which was actually genuinely sent by Walmart.
    - Cpoll 2y ago
      I wouldn't assume a 3-character .com is a phishing domain, they're hardly cheap and disposable. But I get your point, I've seen some suspicious (legitimate) alternate domains. Stuff like (not a real example) amazon-fulfillment.com.
      - nailer 2y ago
        A dash in a domain though is pretty ratchet.
samcat116 2y ago
> what's stopping someone from making a version of the same scheme that redirects to a prompt on the real site which authorizes them as a new user? This would require compromising the website as a whole
amscanne 2y ago
You’re loosely describing a CSRF vulnerability, which do occur but people try to design against them and mitigate them. For example, actions that mutate often require POST (which won’t be triggered by a link), cookies may be marked strict (and not sent from frames or following links), etc.

Arnavion 2y ago

>This flavor of phishing is eliminated by passkeys. ... and also eliminated by password managers that use autofill based on the domain name.

tptacek 2y ago
No it isn't, because people will manually fill things in when autofill doesn't work. People will go out of their way to feed credentials to sites that look authentic; it's a genuinely hard problem. (I've had the displeasure of having to work on it for financial industry clients.)
- GoblinSlayer 2y ago
  So, it's just a password manager that doesn't show you the password? With pwdhash it's difficult to fill things manually too.
- lolinder 2y ago
  Can you elaborate (or provide a source that does) on how passkeys prevent a phisher from just MITMing the initial passkey setup with some nonsense claim about your session expiring? I'm probably mistaken here, but my interactions with passkeys always make them seem to be trust-on-first-use, which is a very phishable strategy.
  - samcat116 2y ago
    Passkeys are tied to a DNS name, so unless they were able to take over the DNS of a site, they wouldn't ever even be offered to authenticate the password. Additionally the private key never leaves the device regardless, so if you were tricked to setup a new passkey on a fake site, you'd just end up creating a new Passkey for it and the site would get some new unique public key.
    - bennettnate5 2y ago
      More than DNS name though--while DNS is susceptible to MITM and cache poisoning, afaik passkeys requires HTTPS so the domain's certificate is validated. Authentication not assertion and all that