4 ms·
Attacker is now logged in on the real crypto portal as Bob. SSH equivalent would be like connecting to malicious server with SSH agent forwarding enabled.
by garaetjjte 2y ago
Attacker is now logged in on the real crypto portal as Bob. SSH equivalent would be like connecting to malicious server with SSH agent forwarding enabled.
- programmarchy 2y agoOkay, that makes sense. I thought they could just log in to a dummy site, not that it was proxying requests through to a real site. Yikes.
- reportgunner 2y agoI suppose you can completely skip dummy sites when phishing for passkeys since the user doesn't know the password and therefore you don't need him to enter said password anywhere (which is why you needed a dummy site in the first place).