Re: A new type of phishing attack

2FACC, i.e., 2 factor access control, is a counterpoint to 2FA; 2FA does not solve phishing, as demonstrated in the field. 2FACC uses a webkey to reach a private login page where you deliver the password. An attacker needs to get both.

http://skyhunter.com/marcs/noPhishing.pdf

--marcs

From: [email protected] [mailto:[email protected]] On Behalf Of Dirk Pranke
Sent: Friday, September 12, 2014 3:16 PM
To: General discussions concerning capability systems.
Subject: Re: [cap-talk] A new type of phishing attack

2FACC? I'm guessing 2FA is two-factor authentication, but what is the CC part?

-- Dirk

On Fri, Sep 12, 2014 at 2:27 PM, Stiegler, Marc <[email protected]<mailto:[email protected]>> wrote:
It is also yet another reminder that webkeys would fix these problems if people would just implement them. Or 2FACC if people would just implement that. Sigh.

--marcs

-----Original Message-----
From: [email protected]<mailto:[email protected]> [mailto:[email protected]<mailto:[email protected]>] On Behalf Of Sandro Magi
Sent: Friday, September 12, 2014 6:33 AM
To: General discussions concerning capability systems.
Subject: [cap-talk] A new type of phishing attack

Interesting new phishing idea:

http://www.azarask.in/blog/post/a-new-type-of-phishing-attack/

Basically exploiting a typical user's workflow where they have multiple tabs open. This highlights the real need for a functional petname system.

As a trivial countermeasure, I wonder if it's really necessary for JavaScript to run on inactive tabs.

Sandro

_______________________________________________
cap-talk mailing list
[email protected]<mailto:[email protected]>
http://www.eros-os.org/mailman/listinfo/cap-talk

_______________________________________________
cap-talk mailing list
[email protected]<mailto:[email protected]>
http://www.eros-os.org/mailman/listinfo/cap-talk

_______________________________________________
cap-talk mailing list
[email protected]
http://www.eros-os.org/mailman/listinfo/cap-talk