News for hackers. Stuff that matters.

A comment on Google: Security Keys Neutralized Employee Phishing. Parent comment

Re:Google: Security Keys Neutralized Employee Phishing by agildehaus on Monday July 23, 2018 @08:32PM (#17597200)
Google and Apple both have mobile (non-SMS) based two factor prompts that seem equally immune to phishing?
[ Parent | on HN ]
Re:Google: Security Keys Neutralized Employee Phishing by SpaethCo on Monday July 23, 2018 @10:02PM (#17597572)
> Google and Apple both have mobile (non-SMS) based two factor prompts that seem equally immune to phishing?

Any "type in a code" or "approve this login (yes/no)?" authentication factor is technically vulnerable. All the phishing site needs to do is proxy the authentication to the actual site in real time.

These guys put together a great overview of the approach: https://www.wandera.com/bypassing-2fa/

[ Parent | on HN ]