Gitlab phished its own work-from-home staff, and 1 in 5 fell for it

Re:Gitlab phished its own work-from-home staff, and 1 in 5 f... by acdha on Saturday May 23, 2020 @05:06PM (#23286446)

No, this is why FIDO/U2F is essential. Password managers are good but people regularly search and autofill across domains because most companies, especially in industries like finance and HR, have spent years training users to expect random vanity domains and renaming every time someone in marketing wants to mark their territory. People phish TOTP similarly.

In contrast, the FIDO design cannot be used across domains no matter how successfully you fool the human.

[ Parent | on HN ]

Re:Gitlab phished its own work-from-home staff, and 1 in 5 f... by ripdog on Sunday May 24, 2020 @01:12AM (#23289291)

Sounds great, but U2F keys are super expensive and U2F is supported nowhere. Password managers are free and work everywhere already.

[ Parent | on HN ]

Re:Gitlab phished its own work-from-home staff, and 1 in 5 f... by acdha on Sunday May 24, 2020 @10:20AM (#23291698)

U2F keys start at $15, so there’s a barrier but it’s hardly “super expensive”, and they’re supported by a fair fraction of major sites (Facebook, Google, Twitter, GitHub, Gitlab, login.gov, etc.).

[ Parent | on HN ]