Hacker News Reader

Comment by mecsred | Hacker News Reader

That's a particular scheme that might be fooled, but what's stopping someone from making a version of the same scheme that redirects to a prompt on the real site which authorizes them as a new user? I'll admit web technologies aren't my area of expertise but I have little doubt it's possible based on my interactions so far. E.g. discord allowing me to log in to a new device by scanning a QR code with my phone and clicking OK.

Ultimately the point of phishing is to attack the user instead of the technology. If the user has any control over access to their account, phishing is largely unaffected.

View on HN

>what's stopping someone from making a version of the same scheme that redirects to a prompt on the real site which authorizes them as a new user

I can give a better answer than the sibling:

The passkey is domain bound, so the UI won't show up on the phishing site before the passthrough can even happen.

Password managers are also domain-bound though.

> Password managers are also domain-bound though.

are also --> can be

Often they allow picking an entry for arbitrary domain names, made necessary by firms (such as Microsoft) randomizing their login domains to look like phishing domains.*

* Not what they are doing, but to the casual user, logging into xbox.com, office.com, or even microsoft.com through something like microsoftonline.com may as well be phishing.

Agreed. Even a few hours ago I got something for w-m.com (!) which was actually genuinely sent by Walmart.

I wouldn't assume a 3-character .com is a phishing domain, they're hardly cheap and disposable. But I get your point, I've seen some suspicious (legitimate) alternate domains. Stuff like (not a real example) amazon-fulfillment.com.

A dash in a domain though is pretty ratchet.

> what's stopping someone from making a version of the same scheme that redirects to a prompt on the real site which authorizes them as a new user?

This would require compromising the website as a whole

You’re loosely describing a CSRF vulnerability, which do occur but people try to design against them and mitigate them. For example, actions that mutate often require POST (which won’t be triggered by a link), cookies may be marked strict (and not sent from frames or following links), etc.

Reply on news.ycombinator.com