4 ms·
The scheme is impossible, because the GOOD site says in the email "NEVER SHARE THIS ONE TIME CODE WITH 3RD PARTY APPS OR INDIVIDUALS"
by avodonosov 1y ago
The scheme is impossible, because the GOOD site says in the email "NEVER SHARE THIS ONE TIME CODE WITH 3RD PARTY APPS OR INDIVIDUALS"
- Perz1val 1y agoPhising = pretending you're the first party
- avodonosov 1y agoTuesday follows Monday
- Perz1val 1y agoI don't know if you're sarcastic or just missing the problem; which is that people will be presented with lika a facebook login page, on a site with url like `facebook.quick-login.com` or `facebock.com` and they'll enter the passcode since as fair as they were concerned, they did everything correct. The disclaimer does shit preventing that, they »obviously« didn't share the code with any other website, they entered it on the facebooks as they were told!
- avodonosov 1y agoI am sarcastic because this discussion is about a different attack. Not about fishing. (The OP says one time codes are worse than passwords. In case of fishing passwords fail the same way as one time codes.) I was also sarcastic/provocative even in the prev comment, saying the GOOD site always includes a warning with the code making the attack impossible. A variation of the attack is very widely used by phone scammers: "Hello, we are updating intercomm on your appartment block. Please tell us your name and phone number. Ok, you will receive a code now, tell it to us". Yet many online services and banks still send one time codes without a warning to never share it! The fishing point may also be used in defence of one time codes: if the GOOD service was using passwords instead of one time codes, the BAD could just initiated fishing attack, redirecting the user to a fake login page - people today are used to "Login with" flow.
- pjc50 1y agoYou left out the /s tag. People don't read that bit.
- avodonosov 1y ago/s tag? Peope do read, if the email is short
- account42 1y agoThey only read what they need to finish what they are currently trying to do, which in this case is the code they need to log in.
- avodonosov 1y agoI know from experience that well designed messages with secure code are very understandable and make it virtually impossible to miss the warning. On what grounds you say people dont read? Any evidence?
- Hackbraten 1y ago> I know from experience that well designed messages with secure code are very understandable This premise seems flawed. How can you possibly know from experience that something is “very understandable” if the only brain you have is your own? How do you anticipate how other people with brains different from yours are going to behave in situations of cognitive impairment or extreme stress, things that happen in the real world?
- avodonosov 1y agoThere are common properties of phycology shared by people. UI design and ergonomics rely on such properties. In psrticular, how people read text. But I am speaking of myself only. From experience receiving well designed message comparing to the experience with badly designed messages. I am a data point of evidence supporing my view. The opinion that "people don't read" is a complete speculation, without convincing evidence. The real problem that many services simply not include the warning in the message.