News for hackers. Stuff that matters.

A comment on Google: Security Keys Neutralized Employee Phishing. Parent comment

Re:Google: Security Keys Neutralized Employee Phishing by toast0 on Monday July 23, 2018 @10:13AM (#17592887)
With TOTP, a sufficiently clever phish may convince you to enter the one time code.

With U2F, there is communication between the browser and the device, requesting authentication for a specific origin hostname -- that can't (shouldn't) be fooled by a phish hosted at Google.com-super-secure-phishing.net

[ Parent | on HN ]
Re:Google: Security Keys Neutralized Employee Phishing by tzs on Monday July 23, 2018 @11:39AM (#17593466)
Where do password managers fit in here? If a phisher convinces me to try to login to google.com-super-secure-phishing.net using my google account I'm going to notice something is wrong when my password manager refuses to fill in the login form.
[ Parent | on HN ]
Re:Google: Security Keys Neutralized Employee Phishing by SpaethCo on Monday July 23, 2018 @12:59PM (#17594026)
This is where it comes down to user behavior. One of the security engineers from Stripe gave a talk about this at Blackhat last year -- she had phishing campaigns that had users ignore that autofill didn't work and manually copied/pasted their password manager credentials into the phishing sites.

https://www.youtube.com/watch?v=Z20XNp-luNA

[ Parent | on HN ]
Re:Google: Security Keys Neutralized Employee Phishing by chimeracoder on Monday July 23, 2018 @01:35PM (#17594306)
> If a phisher convinces me to try to login to google.com-super-secure-phishing.net using my google account I'm going to notice something is wrong when my password manager refuses to fill in the login form.

You say that, but the overwhelming body of evidence from real-life phishing attacks and red-team exercises demonstrates that even very technologically-literate engineers will not consistently notice.

[ Parent | on HN ]
Re:Google: Security Keys Neutralized Employee Phishing by agildehaus on Monday July 23, 2018 @08:32PM (#17597200)
Google and Apple both have mobile (non-SMS) based two factor prompts that seem equally immune to phishing?
[ Parent | on HN ]
Re:Google: Security Keys Neutralized Employee Phishing by SpaethCo on Monday July 23, 2018 @10:02PM (#17597572)
> Google and Apple both have mobile (non-SMS) based two factor prompts that seem equally immune to phishing?

Any "type in a code" or "approve this login (yes/no)?" authentication factor is technically vulnerable. All the phishing site needs to do is proxy the authentication to the actual site in real time.

These guys put together a great overview of the approach: https://www.wandera.com/bypassing-2fa/

[ Parent | on HN ]