News for hackers. Stuff that matters.

A comment on The closest I've ever come to falling for a Gmail phishing attack. Parent comment

Re:The closest I've ever come to falling for a Gmail phishin... by gaia on Wednesday January 11, 2017 @01:47PM (#13376373)
2FA would make it harder to exploit, but phishing attacks are getting fancier. They capture the 2FA code you enter and immediately start a session elsewhere with your password and 2FA. Hardware 2FA, a security key, (such as a Yubikey) is the only likely way to prevent phishing (excluding targets of state actors) https://support.google.com/accounts/answer/6103523?hl=en
[ Parent | on HN ]
Re:The closest I've ever come to falling for a Gmail phishin... by fnl on Thursday January 12, 2017 @09:13AM (#13382289)
> They capture the 2FA code

How can that be done? That's between my phone and Google, so how can they "listen in" on that?

[ Parent | on HN ]
Re:The closest I've ever come to falling for a Gmail phishin... by putlake on Thursday January 12, 2017 @01:56PM (#13385021)
The phishing site will ask you for your 2FA code and then enter it on the real Google login page.
[ Parent | on HN ]
Re:The closest I've ever come to falling for a Gmail phishin... by fnl on Friday January 20, 2017 @06:51AM (#13443143)
Hmm, but that gets us back to "stage one": For that to work, you have to ignore your URL-bar...
[ Parent | on HN ]
Re:The closest I've ever come to falling for a Gmail phishin... by acchow on Wednesday January 11, 2017 @02:35PM (#13376779)
Why would a yubikey prevent this? They can still send the 2FA code to Google to start your session...
[ Parent | on HN ]
Re:The closest I've ever come to falling for a Gmail phishin... by jlebar on Wednesday January 11, 2017 @02:45PM (#13376859)
No, they cannot with the U2F protocol (as implemented by yubikey).

The simplified version is, Google sends the browser a one-time key, which the browser forwards to the HW token to sign with its private key. Then the browser sends this back to the web server to verify, using its copy of the HW token's public key.

This would be vulnerable to MITM attacks, as you say.

So what the protocol actually does is concatenate the nonce sent by the web server with the origin of the web page as seen by the browser and have the HW token sign that. This way the server can verify that the HW token signed the right nonce for the right origin.

See https://docs.google.com/document/d/1SjCwdrFbVPG1tYavO5RsSD1Q..., search for "origin".

[ Parent | on HN ]
Re:The closest I've ever come to falling for a Gmail phishin... by acchow on Wednesday January 11, 2017 @03:33PM (#13377264)
Oh I think I've never used this feature with my Yubikey - it's just been essentially an external keyboard that types rather quickly.
[ Parent | on HN ]
Re:The closest I've ever come to falling for a Gmail phishin... by AlexCoventry on Sunday January 15, 2017 @12:32PM (#13405110)
It's only available on newer yubikeys.
[ Parent | on HN ]
Re:The closest I've ever come to falling for a Gmail phishin... by jamescrowley on Wednesday January 11, 2017 @02:38PM (#13376815)
It's a different protocol. Not an expert but as I understand it U2F isn't totally out of band - the browser communicates the URL so the token you give wouldn't be accepted by Google when it is replayed
[ Parent | on HN ]
Re:The closest I've ever come to falling for a Gmail phishin... by jamescrowley on Wednesday January 11, 2017 @02:42PM (#13376839)
@extrapickles describes it better further down: https://news.ycombinator.com/item?id=13376402
[ Parent | on HN ]
Re:The closest I've ever come to falling for a Gmail phishin... by smeehee on Thursday January 12, 2017 @08:15PM (#13387670)
Google can prompt you to confirm the login via your phone. It appears to work well: there's a time-out, and this time-out is also triggered if a second login attempt is made in parallel (and reaches the confirmation stage).

So… whichever login attempt gets to confirmation stage last wins (not relevant in this situation), and the confirmation screen on (at least) my phone does not indicate anything regarding location (which is highly relevant).

This looks a little weaker than TOTP (you're basically trading a little security for the convenience of not entering a code while keeping the second factor) and a lot weaker than U2F.

[ Parent | on HN ]
Re:The closest I've ever come to falling for a Gmail phishin... by shimon_e on Wednesday January 11, 2017 @02:21PM (#13376690)
> Hardware 2FA, a security key, (such as a Yubikey) is the only likely way to prevent phishing For now.
[ Parent | on HN ]
Re:The closest I've ever come to falling for a Gmail phishin... by semi-extrinsic on Wednesday January 11, 2017 @03:18PM (#13377149)
Or manual challenge-response, like some internet banking tokens have.
[ Parent | on HN ]