Hacker News Reader

Comment by bamboozled | Hacker News Reader

Are you serious?

I'm signing into a website, I get an email when I'm about to sign-in from said domain, I click the link in the email, I'm signed in.

What is this training me to do exactly?

View on HN

Some third party detects you're trying to sign into a website. The third party sends you an email, that email happens to arrive first. You click the link in the email. Now you're on a website that looks like the one you expected (if the third party has done its homework) but is completely in control by the third party.

Apparently things like this do happen, for example when people are buying or selling things on the internet. They get redirected to a pay processing site that looks just like the one from their bank, but steals their money and/or identity instead.

I'm not sure what actual security risk you're talking about here.

I click the magic link, expecting it to sign me in, but instead it takes me to a fake copy of the website which then asks (again) for login details?

Yes, a lot of people will fall for that.

> but instead it takes me to a fake copy of the website ...

This is fine, but ...

> ... which then asks (again) for login details?

This is where the trick lies. The third-party copy doesn't have to ask you for login details. As your parent states: They get redirected to a pay processing site that looks just like the one from their bank, but steals their money and/or identity instead.

The fake site doesn't have to show you details of your account. It has to look just similar enough that enough people will think it's a legit payment site and submit their payment details.

----

There's also a simpler, alternative attack I mention in a sibling comment: https://news.ycombinator.com/item?id=32081724

> Now you're on a website that looks like the one you expected (if the third party has done its homework) but is completely in control by the third party.

A simpler attack would be to for the third-party attempt a login on their end into your account, and if you happen to click on the Magic Link generated by their login attempt, you wouldn't be signing yourself in, but them.

> Some third party detects you're trying to sign into a website.

And this third party can find out how, exactly?

Off the top of my head, even in HTTPS the domain name isn't encrypted, which may be enough to make a good guess.

Or possibly just guessing without evidence because the sending cost of junk email is so low — looking at my junk mail folders, I have reason to believe they guess.

FWIW, I've heard of this type of attack (deliberately timed) being used during house purchases, with a fake destination bank message preceding the real message by a few minutes. Does anyone know if that's real or just an urban legend?

Ah, like that you mean. Thanks. I was thinking of embedded third party code on a website (which might better not be included on sensitive pages).

Reply on news.ycombinator.com