last day (15 days later) » 

Feeds
Feeds
05:19
1
A: Is it bad practice to state the purpose of a verification code?

security_paranoidThere’s one more thing I want to add: social engineering. Including the purpose of the code (e.g. “This is for registering a new device”) could inadvertently aid attackers in phishing or social engineering attempts. Attackers often manipulate victims into sharing information (like codes) by claim...

Alexander The 1st
Alexander The 1st
This reminds me of a common aspect of scams - to claim urgency. After all, if you generally provide information verification codes send to users, then an attacker attempting to phish or spoof you could make the purpose claim to be "For preventing expiration of the account.", and suddenly they'll get a more likely interaction.
Jasen
Jasen
@AlexanderThe1st "Here is your bank transfer verification code for use on our website DO NOT SHARE THIS WITH ANYONE" seems to me much better than "Here is your verification code"
Alexander The 1st
Alexander The 1st
@Jasen: That isn't necessarily a bad idea - the problem is that someone trying to phish or spoof the credentials of the user is going to probably remove the "DO NOT SHARE THIS WITH ANYONE" text for the explicit purpose of...trying to get someone to share it. The site owner, would know something is up - but the end user may not.
Jasen
Jasen
I mean that text should be on the email.
I mean that detail should be on the email that is carrying the code. On the other hand if they are interacting with a forged website you have already lost.
Alexander The 1st
Alexander The 1st
@Jasen: Yeah, I was thinking in the email as well - spoofing emails is relatively easier, if maybe harder than SMS. But the core of the argument I would make is that telling your user implicitly "If you don't know why you were sent this, you can ignore it" by not including information, you prevent scammers from being able to imply urgency when they provide a verification code that does provide additional information to imply urgency. A sort of "Well, I wasn't expecting that code, so it can't actually be important." defence in MFA.
Jasen
Jasen
05:19
what goes between "send a forged email" and "profit"? I thought the goal was to extract the security verification code from the customer.
Alexander The 1st
Alexander The 1st
@Jasen: An action that needs to know where it is being taken. Or perhaps to put it another way: the code, without information, would be like the "Square Hole" meme, but with the defence of not having a cut-out described to the user - they'd go "I don't have a square hole to put put this thing that can fit in a square hole." Whereas a scammer could tell you where to find the square hole by providing it in the same email as part of the "Purpose".
Jasen
Jasen
please explain your proposed attack in detail in you answer
Alexander The 1st
Alexander The 1st
1.) Attacker sends an email with spoofed link, and random verification code that looks correct.

2.) Spoofed link gathers login credentials, and claims invalid verification code.

3.) Attacker takes credentials and aligns them to actual system, and lets the user provide the verification code themselves, now for the attacker.

There's probably more stronger ways to do that - the issue being that the purpose field would provide urgency to the user being attacked, as it discusses the "For preventing expiration of the account" as the reason it was sent, rather than "If this wasn't you, don't us…
Jasen
Jasen
05:38
if the victim is clicking links in emails you have already lost.
I mean if they are interacting with a forged website, nothing is gained by hiding the purpose of the verification code sent to them... if you instead tell them "New login from a different device" "New login from Elbonia" when yuo send the code - that may actually wake them up that they are interacting with a forged website... If you just give them "here is your code for "Baque du xyz", the will already expect that and the website will continue to fool them.
Alexander The 1st
Alexander The 1st
Perhaps, but there are MFA login systems that do provide an email with a link to login after request - Slack is the one that stands out to me immediately, but other systems often report the access attempt with an indication of "If this wasn't you, you will want to secure your account.". I do agree that location information could be important, but that isn't about the purpose of the access, but about the location where access was attempted.
Jasen
Jasen
Some sites only do MFA when they don't see a "remember this device" cookie (or when the cookie is sufficiently stale)
By telling the victim that we believe them to have changed devices or changed location we issue a warning, we take the opportunity to cause dissonance that may hel them spot the attack.
if you're a bank you're not sending your customers login or login-adjacent links. if you're storefront like GOG or Humble then maybe you are, but the stakes are less.
what slack is doing in sending a verification link - by clicking this you verify that we should perform such and such action (allow access from this new device) but I think codes vs links is a different question entirely.
 
10 hours later…
jmoreno
jmoreno
15:55
They would be clicking a link to confirm a verification code they requested seconds ago…that’s totally different from a verification that they never asked for or one embedded in some random message.

last day (15 days later) »