Re: A new type of phishing attack

On 09/12/14 23:27, Stiegler, Marc wrote:
> It is also yet another reminder that webkeys would fix these problems if people would just implement them. Or 2FACC if people would just implement that. Sigh.

The azarask-page also mentions the remedy:

"The Fix

This kind of attack once again shows how important our work is on the
Firefox Account Manager to keep our users safe. User names and passwords
are not a secure method of doing authentication; it’s time for the
browser to take a more active role in being your smart user agent; one
that knows who you are and keeps your identity, information, and
credentials safe."


Too bad, they discontinued it in 2010:
https://hacks.mozilla.org/2010/04/account-manager-coming-to-firefox/


Guido.
> 
> --marcs
> 
> -----Original Message-----
> From: [email protected] [mailto:[email protected]] On Behalf Of Sandro Magi
> Sent: Friday, September 12, 2014 6:33 AM
> To: General discussions concerning capability systems.
> Subject: [cap-talk] A new type of phishing attack
> 
> Interesting new phishing idea:
> 
> http://www.azarask.in/blog/post/a-new-type-of-phishing-attack/
> 
> Basically exploiting a typical user's workflow where they have multiple tabs open. This highlights the real need for a functional petname system.
> 
> As a trivial countermeasure, I wonder if it's really necessary for JavaScript to run on inactive tabs.
> 
> Sandro
> 
> _______________________________________________
> cap-talk mailing list
> [email protected]
> http://www.eros-os.org/mailman/listinfo/cap-talk
> 
> _______________________________________________
> cap-talk mailing list
> [email protected]
> http://www.eros-os.org/mailman/listinfo/cap-talk
>

_______________________________________________
cap-talk mailing list
[email protected]
http://www.eros-os.org/mailman/listinfo/cap-talk

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Icedove - http://www.enigmail.net/

iQIcBAEBAgAGBQJUE2rFAAoJEHPd8GglaNRm1R0P/1U4+HHKcA05rk3H7MyvLfMg
OpD7i9l0EQ41v3T1pGciRkAcoljQ0Pr788XoWef+leqCO2HPpyo2yFILp4StHhaN
fPAcxKoNk4xEmQ9gIG/hd78oSXadVvG3838B+aeJlYXUUgXFog++IwSdfRApJ6gp
LTosX51cAEFqrK8GzuN3sV6LDH2Bppek3Q4vHIIUAq+CV7aJ9QO4V0Yg9fh+/0V9
SoFjFtkTd7fOGL8yk63J3JPDU3gcYnfrcvcG+sAWPFC9GHhHQwu+ZfoNMUcsm4AD
iVn7a6I+iOm2yU3+DQtmZ2AKi/oZKJACLkm+oTx1S/3JZJ7kiPI5+SavjKX+JAUI
JLZ2Vh53/FivgnE5vQjVvqGFn3cH7UWd1nP4TQRrHFZD2sdc2cznoLwMWjl0fJko
Bi33NyY9DtIZuwFcua9aoWj+rE2v3bt898YsLPNGu0tfs9nkP6rEPLJpUVuah6dB
OHUXz9e0rO/oPiO4WvhldT3pykwUpa1a1x5IR+97eC13550Osw7NlVhAzpKq6tt1
AHhRU+jdwVDHPLFLUN1qDsFwWdgMXn+/Vvotog+GrFnFix7XMP4PfeyUhPM1Uyqh
+DBbyNjtRbLQxyaFahhCtbn8h5apiAHroPQnEqbr03FL0x3NCJooQAzTVzRkZBLR
Hs4tmcL4FB7eNtPtOq5U
=Y2Kv
-----END PGP SIGNATURE-----