<story><title>We Got Phished</title><url>https://www.exploratorium.edu/blogs/tangents/we-got-phished-2</url></story><parent_chain><item><author>ryanobjc</author><text>2 factor authentication is key here. The ubikey is a gold standard for business - no one should do serious business without it!&lt;p&gt;For everyone else, I think the new 2fa Google App approach is better.  When you go to login, your Google App pushes a notification to your phone and you have to click on it.  This raises the bar to doing a simultaneous login, which isn&amp;#x27;t impossible, but even if it weeds out a large number of attacks for now, it&amp;#x27;s worth it!</text></item></parent_chain><comment><author>laurencei</author><text>Does 2 factor prevent phishing though?&lt;p&gt;If I was going to do a Google Phishing page - I would take the username + password that the user supplied into MY fake page, and POST&amp;#x2F;CURL that to the Google login.&lt;p&gt;If Google returns asking for a 2factor to MY fake, I would display the 2 factor prompt to the user, and get them to type the 2-factor into my page, which I would pass back to Google.&lt;p&gt;Basically you can use a phishing page as a MITM attack.&lt;p&gt;When you auth against Google with 2-factor, there is a &amp;quot;remember this computer&amp;quot; option - giving the attacker at least 30 days of access to your email without needing a further 2-factor code.&lt;p&gt;So if the person is tricked enough to type their username+password into a fake google page, they are just as likely to follow through with their 2-factor code.</text></comment>
<story><title>We Got Phished</title><url>https://www.exploratorium.edu/blogs/tangents/we-got-phished-2</url></story><parent_chain><item><author>ryanobjc</author><text>2 factor authentication is key here. The ubikey is a gold standard for business - no one should do serious business without it!&lt;p&gt;For everyone else, I think the new 2fa Google App approach is better.  When you go to login, your Google App pushes a notification to your phone and you have to click on it.  This raises the bar to doing a simultaneous login, which isn&amp;#x27;t impossible, but even if it weeds out a large number of attacks for now, it&amp;#x27;s worth it!</text></item></parent_chain><comment><author>kovek</author><text>Well, on a phishing page the user could still type in the username and password before clicking submit. Only after submitting the username and password do authentication layers require the user to interact with their mobile device (which is usually how it works). Some users might forget that they are supposed to 2FA (say, on their first few days at the job).&lt;p&gt;What if the password input would only be shown after the user typed in their username, pressed submit and confirmed that they were trying to log in using their mobile device?&lt;p&gt;* Input username&lt;p&gt;* Press submit&lt;p&gt;* Interact with mobile device for 2FA&lt;p&gt;* Input password&lt;p&gt;* Press submit</text></comment>