4 ms·

Legacy 2FA like OTP or SMS isn't going to protect you from this kind of phishing (as shown). However webauthn with a security key or passkey would have prevente

Legacy 2FA like OTP or SMS isn't going to protect you from this kind of phishing (as shown). However webauthn with a security key or passkey would have prevented this. Unfortunately mailchimp doesn't support those.

freehorse 2y ago
Passkeys face a similar issue to when password managers don’t autocomplete credentials: we’re accustomed to technology not working well due to poor implementations, so when it does not work we may assume it’s just unreliable and resort to alternative authentication methods instead of suspecting something suspicious. Of course, when they work well, they are much more secure, and if passkeys were reliable enough to not ever need passwords that would solve a lot.
- rocqua 2y ago
  I thought that passkeys were domain-bound through a challenge response mechanism? That should completely prevent fishing of this simple MitM the 2nd factor. At least, that's how I've seen it be sold.
  - fc417fc802 2y ago
    Yes. So when it prevents the phishing attempt there's a good chance that quite a few people will assume something broke and attempt an alternative login method - with the phishing "service".
raverbashing 2y ago
By that logic "legacy 2FA" does nothing then and it's just another inconvenience created for security theatre purposes (which I almost agree) and we must hence have another auth step for extra inconvenience and easy of locking yourself out of your accounts
- jsiepkes 2y ago
  > another auth step for extra inconvenience and easy of locking yourself out of your accounts I think it depends on the context how one would solve that. For example in our company we made (webauthn) security keys mandatory (as well as 2FA itself) for our internal IdP and disabled all other 2FA methods. All account recovery methods such as SMS, phone, email, etc. are also disabled. If someone looses their key it means they need to go to IT to re-provision a new one in their account. In practice this almost doesn't happen. In return we get a setup in which even less tech-savy people are quite hard to phish. Overall people seem to be pretty happy with the setup. For example they don't need to lookup and enter TOTP codes, they just need to press a button. In Troy's case you might want to use a second (backup) security key.

freehorse 2y ago

Passkeys face a similar issue to when password managers don’t autocomplete credentials: we’re accustomed to technology not working well due to poor implementations, so when it does not work we may assume it’s just unreliable and resort to alternative authentication methods instead of suspecting something suspicious. Of course, when they work well, they are much more secure, and if passkeys were reliable enough to not ever need passwords that would solve a lot.

rocqua 2y ago
I thought that passkeys were domain-bound through a challenge response mechanism? That should completely prevent fishing of this simple MitM the 2nd factor. At least, that's how I've seen it be sold.
- fc417fc802 2y ago
  Yes. So when it prevents the phishing attempt there's a good chance that quite a few people will assume something broke and attempt an alternative login method - with the phishing "service".

raverbashing 2y ago

By that logic "legacy 2FA" does nothing then and it's just another inconvenience created for security theatre purposes (which I almost agree) and we must hence have another auth step for extra inconvenience and easy of locking yourself out of your accounts

jsiepkes 2y ago
> another auth step for extra inconvenience and easy of locking yourself out of your accounts I think it depends on the context how one would solve that. For example in our company we made (webauthn) security keys mandatory (as well as 2FA itself) for our internal IdP and disabled all other 2FA methods. All account recovery methods such as SMS, phone, email, etc. are also disabled. If someone looses their key it means they need to go to IT to re-provision a new one in their account. In practice this almost doesn't happen. In return we get a setup in which even less tech-savy people are quite hard to phish. Overall people seem to be pretty happy with the setup. For example they don't need to lookup and enter TOTP codes, they just need to press a button. In Troy's case you might want to use a second (backup) security key.