News for hackers. Stuff that matters.

A comment on The closest I've ever come to falling for a Gmail phishing attack. Parent comment

Re:The closest I've ever come to falling for a Gmail phishin... by oxguy3 on Wednesday January 11, 2017 @08:16AM (#13373677)
Oh my god that's awful, what's the point of making it so counterintuitive?? I'll never understand the motivation of companies that roll their own 2FA instead of just using TOTP or Authy.
[ Parent | on HN ]
Re:The closest I've ever come to falling for a Gmail phishin... by Jarwain on Wednesday January 11, 2017 @08:40AM (#13373780)
It was probably the worst way they could have implemented 2FA; we're still vulnerable to a MITM attack.

One of the more annoying things is that the codes are sent from a random 386 number. Out of the 7+ texts I've received thus far, only 2 were from the same number.

Apparently the company they're using is named https://duo.com/

[ Parent | on HN ]
Re:The closest I've ever come to falling for a Gmail phishin... by grivescorbett on Wednesday January 11, 2017 @09:19AM (#13373986)
That's odd, we use duo at work and it's great. Every user is configured to get a push notification directly to the device which bypasses the issues with SMS.
[ Parent | on HN ]
Re:The closest I've ever come to falling for a Gmail phishin... by Jarwain on Wednesday January 11, 2017 @10:05AM (#13374356)
That requires the user to use the Duo app though, right?

I don't recall whether I had the option to use the app when I enabled MFA initially. However, after the fact, and as far as I can find, I cannot go back and enable the app.

[ Parent | on HN ]
Re:The closest I've ever come to falling for a Gmail phishin... by grivescorbett on Wednesday January 11, 2017 @10:19AM (#13374503)
That's correct, of course without having the app installed there is no option other than SMS or a hardware token.

I remember that configuring this is tricky, but I did eventually get user self enrollment configured with push being the default. Happy to dig more into my config, if you're curious: [email protected]

[ Parent | on HN ]
Re:The closest I've ever come to falling for a Gmail phishin... by Jarwain on Wednesday January 11, 2017 @10:51AM (#13374762)
Totally curious, unfortunately it'd probably go in one eye and out the other since I'm not involved in the Uni's implementation.
[ Parent | on HN ]
Re:The closest I've ever come to falling for a Gmail phishin... by nerdponx on Wednesday January 11, 2017 @09:15AM (#13373965)
Huh, I've heard good things about Duo. They're not a nobody at any rate.
[ Parent | on HN ]
Re:The closest I've ever come to falling for a Gmail phishin... by hobarrera on Wednesday January 11, 2017 @11:44AM (#13375221)
We have security experts developing 2fa techniques, and then we have these sort of people.
[ Parent | on HN ]