Re:Someone Mailed Me an Amazing Phishing Page of Google Login
by Someone1234 on Wednesday January 21, 2015 @04:12PM
(#8925807)
Yes it could.
However it would only have 60 seconds (30 + 30 sec) to forward that to Google along with your credentials. It cannot be done via the user's browser due to forgery protection on Google's end, so a third party piece of software would have to grab the credentials including 2f code and log in using a "browser" (e.g. WebKit engine).
One challenging problem is for the site to know if it should prompt you for the 2f code. It won't know until it tries to login, and it won't be able to try and login until it forwards your credentials to a third party piece of software and then gets a reply back. Even assuming this is done very fast, it could still take a few seconds, in particular if Google starts to throttle their client's IP.
It would likely be easier just to target low hanging fruit (i.e. non-2F people) unless this is a targeted attack.
However it would only have 60 seconds (30 + 30 sec) to forward that to Google along with your credentials. It cannot be done via the user's browser due to forgery protection on Google's end, so a third party piece of software would have to grab the credentials including 2f code and log in using a "browser" (e.g. WebKit engine).
One challenging problem is for the site to know if it should prompt you for the 2f code. It won't know until it tries to login, and it won't be able to try and login until it forwards your credentials to a third party piece of software and then gets a reply back. Even assuming this is done very fast, it could still take a few seconds, in particular if Google starts to throttle their client's IP.
It would likely be easier just to target low hanging fruit (i.e. non-2F people) unless this is a targeted attack.