News for hackers. Stuff that matters.

A comment on No Privacy in the Electronics Repair Industry. Parent comment

Re:No Privacy in the Electronics Repair Industry by alpaca128 on Wednesday November 30, 2022 @04:01AM (#33798463)
You build a fake website. The victim enters their ID and password. The fake website asks for the SMS TAN. The victim gets an SMS from the actual bank and enters the TAN. Profit.

It doesn't have any security benefit for phishing like this, it's just one additional password input field.

[ Parent | on HN ]
Re:No Privacy in the Electronics Repair Industry by jaclaz on Wednesday November 30, 2022 @04:28AM (#33798632)
Sure, but in this case, like in many "phishing" schemes, there is no interception of the SMS, this same approach applies to all other authentication tokens, as it is the victim that enters the OTP on the (fake) site or communicates it to the phisher who calls impersonating a bank employee.
[ Parent | on HN ]
Re:No Privacy in the Electronics Repair Industry by Eisenstein on Wednesday November 30, 2022 @05:07AM (#33798869)
> this same approach applies to all other authentication tokens

Not true. FIDO and prevents this. The key is bound to the site you authorized it on, so inputting the key while connected to a phishing site will do nothing.

* https://www.yubico.com/authentication-standards/fido-u2f/

[ Parent | on HN ]
Re:No Privacy in the Electronics Repair Industry by jaclaz on Wednesday November 30, 2022 @07:25AM (#33799723)
Yes, I meant those (I believe much more common) various hardware token generators and those "in-app" ones (issued by the bank), that end up as a 6 or 8 digits that you have to type on the site.
[ Parent | on HN ]