Google: Security Keys Neutralized Employee Phishing

Re:Google: Security Keys Neutralized Employee Phishing by SpaethCo on Monday July 23, 2018 @12:34PM (#17593835)

This is the thing I struggle with: name a scenario where you would have your unique site password compromised but not have at least 1 valid 2FA code compromised at the same time.

The best answer I have for where TOTP can provide value: you can limit a potential attack to a single login.

I wanted to say you could stop someone doing MitM decryption due to timing (you use the 2FA code before they can), but if they're decrypting your session they can most likely just steal your session cookie which gets them what they need anyway.

[ Parent | on HN ]

Re:Google: Security Keys Neutralized Employee Phishing by dgacmu on Monday July 23, 2018 @05:43PM (#17596274)

Because you accidentally type your password for site A into the login for site B.

[ Parent | on HN ]

Re:Google: Security Keys Neutralized Employee Phishing by leokennis on Tuesday July 24, 2018 @01:15AM (#17598272)

Someone “hacking” the 1Password web service

Logging in to a site on a public computer and the browser auto-remembers the password you typed

A border agent forcing you to log into a website (this scenario only works if you leave your second factor, which will most likely be your phone, at home)

[ Parent | on HN ]

Re:Google: Security Keys Neutralized Employee Phishing by Damogran6 on Tuesday July 24, 2018 @09:37AM (#17600853)

Usually in a higher security environment, we'll make sure the authenticator is a separate device (phone or hard token) and expressly forbid having a soft token on the same device that has the password safe.

[ Parent | on HN ]