News for hackers. Stuff that matters.

A comment on WA man set up fake free WiFi at Australian airports and on flights,police allege. Parent comment

Re:WA man set up fake free WiFi at Australian airports and o... by goldpizza44 on Friday June 28, 2024 @07:06AM (#40819450)
sounds like he was simulating openid-connect flows by saying "login with Google" or "login with Facebook" and then storing the credentials entered which would be cleartext.

I always suspicious of these flows for specifically this reason. The flows are secure as long as you know you are talking to the correct identity provider, but I think most laymen would not understand that concept.

[ Parent | on HN ]
Re:WA man set up fake free WiFi at Australian airports and o... by kevincox on Friday June 28, 2024 @08:21AM (#40819907)
This is why using a password manager with browser integration is critical. If the password doesn't auto-fill something is wrong.
[ Parent | on HN ]
Re:WA man set up fake free WiFi at Australian airports and o... by tomr75 on Friday June 28, 2024 @02:29PM (#40823535)
or use a passkey
[ Parent | on HN ]
Re:WA man set up fake free WiFi at Australian airports and o... by WolfeReader on Friday June 28, 2024 @02:45PM (#40823746)
Gotta be careful with that too. If your password manager offers to auto-fill on the base domain - for example, *.google.com, it would be fooled by any phishing site hosted on google sites or google forms.
[ Parent | on HN ]
Re:WA man set up fake free WiFi at Australian airports and o... by marshmellman on Saturday June 29, 2024 @01:17AM (#40828038)
Wow, that seems like a huge security risk for Google that people can create phishing sites on their auth domain. I don’t think Google Forms allows login forms, but I’m surprised Google Sites would offer hosting on the primary Google domain.
[ Parent | on HN ]