3 ms·
I think you can MITM this by presenting legitimate (proxied) ycombinator.com QR codes on e.g. ycombigator.com. The app would still authenticate to the legitima
by nly 13y ago
I think you can MITM this by presenting legitimate (proxied) ycombinator.com QR codes on e.g. ycombigator.com.
The app would still authenticate to the legitimate site and then 'activate' the session, and ycombigator.com could have at it. HTTPS won't help either. The problem is there's no way for the phone app to transfer additional secure session cookies back to your desktop browser, so this has to be the case.
Sure, the app will display the legitimate domain or URL but the user probably thinks that's what they're viewing on their desktop anyway, so will likely accept.
Requires mutual authentication.
- gcr 13y agoThis attack can be stopped by referer checking. A site that hosts a QR code should display a warning instead of the QR code if the referer doesn't match.
- nly 13y agoThe malicious site in the middle can download the legit QR server side (e.g. using PHP) and simply spoof the referer, then present it to the visitor. Where will a referer check help?
- gcr 13y agoThat's a great point. I didn't think of that.
- phpnode 13y agohttps does not expose referrer, and you are logging in through https, right?