3 ms·

A phisher's dream.

• gepeto42 2y ago
  Yeah exactly. Plus, sometimes SOMETHING will click the link before it even gets to the person's inbox (some enterprise spam filter with a sandboxed browser for example). edit: saw that nicce basically said that a second before I hit post.
• nicce 2y ago
  All the email scanners likely trigger the process anyway.
• jameshart 2y ago
  Solvable with the right information in the authorizing email. Remember that the flow the magic link is part of is one you initiate, that causes you to get an email you are expecting. That email, and the landing and confirmation page it links you to, can explain very clearly that you are only supposed to authorize this if you are trying to log in on known device in known location that is displaying recognizable number on the screen right now.
  • Mystery-Machine 2y ago
    You're assuming users read.
  • avidiax 2y ago
    Rather than a recognizable number, users should be prompted to select a matching non-pronounceable glyph. Something like the keypads from KTANE [1]. That makes it impossible to text or speak it to a phisher. Bonus points if you show the symbol as a noisy animated glyph, something like [2], or a link to a DRM'd video showing a symbol. That would make it very difficult to view even with screen recording or remote desktop software. [1] https://www.bombmanual.com/web/index.html#:~:text=On%20the%20Subject%20of%20Keypads https://www.bombmanual.com/web/index.html#:~:text=On%20the%2... [2] https://www.youtube.com/watch?v=RNhiT-SmR1Q https://www.youtube.com/watch?v=RNhiT-SmR1Q
    • Jerrrry 2y ago
      The thought of using unpronounceable text to deter phishing attempts reminds me of putting illegible Unicode as challenge question answers to prevent the CSR from giving an account away to convincing social engineers.
    • layer8 2y ago
      There is a substantial class of users this would be too much to ask of, i.e. they wouldn’t understand it or would assume that they are being scammed somehow.
    • forgotusername6 2y ago
      And then when you need to provide an accessible version?
  • michaelmior 2y ago
    > the flow the magic link is part of is one you initiate There's nothing stopping anyone else from initiating the flow assuming the common implementation where only an email is required to initiate sending the link.
    • jameshart 2y ago
      Yes and when you receive an email saying Here is the link you requested from ‘Android Device’ in ‘Belarus’ - click here to sign in and allow that device to access your account - only click this if you requested this email You don’t click the link if you didn’t request it.
      • lcnPylGDnU4H9OF 2y ago
        The phisher will be on the phone with their victim, pretending to be a support agent for the business. They will say, "Yes click the link, that's how you verify with us."
        • jameshart 2y ago
          So many people on this thread leaping in with the phishing threat model. This is a simple quick login process, you wouldn’t use it in a place where 2FA is required. It is a mistake to think of this as a substitute for 2FA just because it has some of the same elements as a secondary device authentication. It’s not intended to be a 2 FA flow though! It’s a single factor - ‘does the user have access to a device that can read emails sent to this associated email address’. We aren’t combining it with a password or anything else. That is the same level of auth used for things on many services like ‘registering for a free account’, and frequently for ‘resetting the password on an account’. It’s not a complete security solution and you wouldn’t use it everywhere. It would be a bad fit for a banking app or access to a publishing interface. It’s not a bad interface for things like ‘logging in to my subscription on the TV’ or ‘returning as a customer to a website I shopped with once before’.
      • jonplackett 2y ago
        You might not. Your granny? Maybe.
• Findecanor 2y ago
  BankID scams in Sweden worked because it did not require there to be authentication between the device that logged in and the device that authorised the login. The victim got a phone call in which the she got manipulated into authorising something in the BankID smartphone app. But what she was actually doing was authorising the attacker to log into her online bank account. First after several years (of blaming the thousands of victims for their millions lost) did the system start using QR codes on the screen scanned by the smartphone.