Re:Google: Security Keys Neutralized Employee Phishing
by tzs on Monday July 23, 2018 @11:39AM
(#17593466)
Where do password managers fit in here? If a phisher convinces me to try to login to google.com-super-secure-phishing.net using my google account I'm going to notice something is wrong when my password manager refuses to fill in the login form.
[ Parent
| on HN ]
Re:Google: Security Keys Neutralized Employee Phishing
by SpaethCo on Monday July 23, 2018 @12:59PM
(#17594026)
This is where it comes down to user behavior. One of the security engineers from Stripe gave a talk about this at Blackhat last year -- she had phishing campaigns that had users ignore that autofill didn't work and manually copied/pasted their password manager credentials into the phishing sites.
Re:Google: Security Keys Neutralized Employee Phishing
by chimeracoder on Monday July 23, 2018 @01:35PM
(#17594306)
> If a phisher convinces me to try to login to google.com-super-secure-phishing.net using my google account I'm going to notice something is wrong when my password manager refuses to fill in the login form.
You say that, but the overwhelming body of evidence from real-life phishing attacks and red-team exercises demonstrates that even very technologically-literate engineers will not consistently notice.