News for hackers. Stuff that matters.

A comment on Microsoft Confirms Password Deletion for 1B Users. Parent comment

Re:Microsoft Confirms Password Deletion for 1B Users by mecsred on Tuesday December 17, 2024 @02:22PM (#42444345)
That's a particular scheme that might be fooled, but what's stopping someone from making a version of the same scheme that redirects to a prompt on the real site which authorizes them as a new user? I'll admit web technologies aren't my area of expertise but I have little doubt it's possible based on my interactions so far. E.g. discord allowing me to log in to a new device by scanning a QR code with my phone and clicking OK.

Ultimately the point of phishing is to attack the user instead of the technology. If the user has any control over access to their account, phishing is largely unaffected.

[ Parent | on HN ]
Re:Microsoft Confirms Password Deletion for 1B Users by samcat116 on Tuesday December 17, 2024 @03:36PM (#42445045)
> what's stopping someone from making a version of the same scheme that redirects to a prompt on the real site which authorizes them as a new user?

This would require compromising the website as a whole

[ Parent | on HN ]
Re:Microsoft Confirms Password Deletion for 1B Users by nailer on Tuesday December 17, 2024 @03:02PM (#42444728)
>what's stopping someone from making a version of the same scheme that redirects to a prompt on the real site which authorizes them as a new user

I can give a better answer than the sibling:

The passkey is domain bound, so the UI won't show up on the phishing site before the passthrough can even happen.

Password managers are also domain-bound though.

[ Parent | on HN ]
Re:Microsoft Confirms Password Deletion for 1B Users by Terretta on Wednesday December 18, 2024 @10:41AM (#42451339)
> Password managers are also domain-bound though.

are also --> can be

Often they allow picking an entry for arbitrary domain names, made necessary by firms (such as Microsoft) randomizing their login domains to look like phishing domains.*

* Not what they are doing, but to the casual user, logging into xbox.com, office.com, or even microsoft.com through something like microsoftonline.com may as well be phishing.

[ Parent | on HN ]
Re:Microsoft Confirms Password Deletion for 1B Users by nailer on Wednesday December 18, 2024 @07:14PM (#42456955)
Agreed. Even a few hours ago I got something for w-m.com (!) which was actually genuinely sent by Walmart.
[ Parent | on HN ]
Re:Microsoft Confirms Password Deletion for 1B Users by Cpoll on Thursday December 19, 2024 @02:23PM (#42464827)
I wouldn't assume a 3-character .com is a phishing domain, they're hardly cheap and disposable. But I get your point, I've seen some suspicious (legitimate) alternate domains. Stuff like (not a real example) amazon-fulfillment.com.
[ Parent | on HN ]
Re:Microsoft Confirms Password Deletion for 1B Users by nailer on Thursday December 19, 2024 @03:44PM (#42465536)
A dash in a domain though is pretty ratchet.
[ Parent | on HN ]
Re:Microsoft Confirms Password Deletion for 1B Users by amscanne on Tuesday December 17, 2024 @10:26PM (#42447859)
You’re loosely describing a CSRF vulnerability, which do occur but people try to design against them and mitigate them. For example, actions that mutate often require POST (which won’t be triggered by a link), cookies may be marked strict (and not sent from frames or following links), etc.
[ Parent | on HN ]