Making Unphishable 2FA Phishable

Re:Making Unphishable 2FA Phishable by dinosaurdynasty on Thursday December 01, 2022 @10:02AM (#33817100)

The token could be made only usable by the cli process that asked for it (should be really).

[ Parent | on HN ]

Re:Making Unphishable 2FA Phishable by Thorrez on Friday December 02, 2022 @02:53AM (#33827986)

Yes, but that doesn't stop this attack.

1. Attacker runs the cli process to generate the URL

2. Attacker sends the URL to the victim saying "as a second factor verification, you need to copy this code into this form"

3. Victim does it

4. Attacker enters the code into the original cli process

[ Parent | on HN ]