Comment by dboreham
3 months ago
I see (I think): they tricked you into entering a TOTP code into their site, which they then proxied to the real names, thereby authenticating as your account. Is that correct?
3 months ago
I see (I think): they tricked you into entering a TOTP code into their site, which they then proxied to the real names, thereby authenticating as your account. Is that correct?
It only proves that TOTP is useless against phishing.
Every day brings me another reason to ask the question: "Why the hell did they throw away the idea of mutual TLS?". They then went onto invent mobile OTP, HOTP, TOTP, FIDO-U2F and finally came a full cycle by reinventing the same concept, but in a more complex incarnation - Passkeys.
Works this way for my government and my bank. I was given a cert matching my real name and the login just asks for my cert and pulls me through (with additional 2FA for the bank). Pretty amazing if you ask me.
3 replies →
the UI for client side certificates was shit for years. no one particularly cared. passkeys however are... pretty reasonable.
7 replies →
Because the tech industry egregore is a middling LLM that gets it context window compacted every generation.
TOTP isnt designed to be against phishing. Its against weak, leaked or cracked passwords.
Lots of junk TOTP apps in app stores.
Once heard of a user putting in a helpdesk ticket asking why they had to pay for the TOTP app. Then I realize their TOTP seed is probably out in the open now.
I’m sure we can imagine how else this could go badly…
No. It only proves that TOTP, as implemented by mobile apps, is useless against phishing.
The extension from https://authenticator.cc, with smart domain match enabled, would have caught this by showing all other TOTP codes besides the one intended by NPM.
On a Mac, Keychain would also have caught this by not autofilling: https://support.apple.com/en-ph/guide/passwords/mchl873a6e72...
Yes. This attack would not have worked if FIDO2 (or the software emulation Passkey) had been used.
Seems so, yes.