6 ms·
I don't understand your example. > 2) BAD website says “We’ve sent you an email, please enter the 6-digit code! The email will come from GOOD, as they are our
by dogpuncher 1y ago
I don't understand your example.
> 2) BAD website says “We’ve sent you an email, please enter the 6-digit code! The email will come from GOOD, as they are our sign-in partner.”
Does that mean that GOOD must be a 3rd party identity provider like Facebook, Apple, Google etc?
- Philpax 1y agoBAD is lying about GOOD and presenting GOOD's legitimate service as a mere IdP for BAD, such that the user provides their code for GOOD to BAD so that the latter can then automatically log into GOOD.
- hombre_fatal 1y agoNo, BAD just inserts your email address on GOOD’s login page which sends you the login code, and they lie to prime you into thinking it’s not suspicious that the email came from someone other than BAD. When you insert the login code on BAD, BAD uses it to finish the login process on GOOD that they started “on your behalf”.
- Almondsetat 1y agoThis attack technique is called "real time phishing". If you need a diagram or a more detailed explanation, look it up
- atoav 1y agoBAD assumes: 1. you got login credentials at GOOD 2. you're using the same email address there They then tell you GOOD will send you a code that you have to enter on their website. Then they enter your Email on GOOD and request a reset, which sends a mail with a code to you. You then enter the code on their website. Now that they have the code they can enter it on GOOD and they have your account.
- lmm 1y agoThey don't have to actually be a 3rd party identity provider, just the user has to find it plausible that they might offer 3rd party login. Which, to be honest, pretty much any big or even medium-sized tech company might be doing these days.
- ErneX 1y agoThere are sites that send you immediately a 6 digit code just by entering your email on their sign in page, they don’t even request a password. That means you could be phished on a fake website that when you enter your email there they do it on the real site, then you receive the real good code and enter it on the fake site.
- johnisgood 1y agoIt is just the same old stuff with username & password combination. I used to duplicate websites, they looked exactly like the original, except I was storing the entered username and password combination. I did this when I was a kid. The process is the same (or very similar) with everything else that is not a password.
- ErneX 1y agoTrue, they do it to facilitate access to their site without a password, but personally I don’t like getting an email just because I entered my username to sign in (my password manager takes care of filling the form so that email with a code is unnecessary to me).
- johnisgood 1y agoI agree, I do not want an email either.