Hacker News Reader

Comment by roc | Hacker News Reader

How does two-factor cut down on phishing again?

Instead of a fake login page with 2 boxes, a phisher could just create a fake login page with 3 boxes and pass the keycode along with everything else.

The only increased difficulty in phishing, is if the user notes they're seeing a keycode prompt, decides that they probably shouldn't have to enter that again and doesn't just key it in anyway.

When we're talking about people who fall for phishing scams, does that sound all that likely? I mean, these people have a history of ignoring red flags and being blissfully ignorant to what should even raise a red flag.

Now, what two-factor will help mitigate, is casual sniffing, keylogging, shoulder-surfing and saved password cracking.

View on HN

The keycode is unique to each log-in attempt.

While I have used this kind of authentication before, I'm not intimately familiar with it. From the way Kincaid described it in the article, it seems the key is unique only to a general moment in time, not each log-in attempt (though it wouldn't be hard to imagine it being invalidated as soon as it was used).

If it is only a moment in time, I assume the phishing script could simply log in at the same time and hope the user has the "once per computer" setting enabled. Though this seems like too big of something to miss. Can anyone offer some clarification?

Is this a stand-alone fob-style system, where the keycode is unique to a point in time with no knowledge of the connection? Or is this some sort of second-channel verification, where the requesting connection is hashed into the one-time-pad?

Both Paypal and WoW use standalone FOB, keycode unique to a point in time.

Of course, paypal's "I lost my authenticator, log me in anyways" button is kind of defeating the purpose...

Ok, but what is Google offering?

Unless I'm missing something, RFC 4226 sounds like the RSA SecurID system I've worked with before; which is essentially equivalent to Blizzard's system for World of Warcraft.

In which case, my criticism stands. It's trivially more difficult to phish a keycode and the limited window of opportunity is simply a non-issue.[1]

Unless Google is calculating a one-time pad based on the individual login attempt and sending it along a second channel to the registered user, there'll be almost no reduction in phishing.

[1] The tens of seconds a keycode is valid are more than enough to establish a connection.

Which means you phished it once. Which means you need to take drastic actions to exploit it, a slow buildup over time is not an option.

Which in turn means you're more likely to get detected. It's not full protection - you'd still need a second channel for that - but it's better than nothing.

It is certainly better than nothing. I just took issue with the article's repeated insistence that it'd make phishing harder/impossible.

It does many good things. That is not one of them.

For the systems I log in to, each SecurID code is only valid once. If you want to log in again, you need to wait until a new code is available and use it.

See: http://en.wikipedia.org/wiki/HOTP and http://en.wikipedia.org/wiki/Time-based_One-time_Password_Al...

You can download the Google Authenticator app.

These algorithms are known. You can implement it yourself if you wanted to.

Stand-alone where the keycode is unique to a point in time with no knowledge of the connection.

It is important to distinguish between active and passive attacks.

The verification code generated is valid only for a very short time - so unless the hacker phishes the code, and uses it within 10s of seconds, the code is not valid.

Nothing's stopping the phishing site from going and logging in once the token's phished, and logging the cookie as opposed to just logging the password+token.

And you get a lot more seconds if you log in within those 10 seconds.

As I understand it, you need a secure & clean initial set-up, after which the user should not have to enter a key again as the handshake between your machine and Google will automatically change.

Phishing won't work if the user does not have to enter the key again. It requires a clean (no keylogger etc) initial setup. Once installed if someone phishes the end user wouldn't need to re-enter a key, thus defeating the phishing scheme.

Reply on news.ycombinator.com