Re:Making Unphishable 2FA Phishable
by Thorrez on Thursday December 01, 2022 @01:43AM
(#33813114)
Copy and paste means a user can be phished. The user can copy and paste it to an attacker.
[ Parent
| on HN ]
Re:Making Unphishable 2FA Phishable
by dinosaurdynasty on Thursday December 01, 2022 @10:02AM
(#33817100)
The token could be made only usable by the cli process that asked for it (should be really).
Yes, but that doesn't stop this attack.
1. Attacker runs the cli process to generate the URL
2. Attacker sends the URL to the victim saying "as a second factor verification, you need to copy this code into this form"
3. Victim does it
4. Attacker enters the code into the original cli process