Kurt Got Got

353 points by tabletcorry 221 days ago | 241 comments

bradgessler 221 days ago |

When we did annual pen testing audits for my last company, the security audit company always offered to do phishing or social engineering attacks, but advised against it because they said it worked every single time.

One of the most memorable things they shared is they'd throw USB sticks in the parking lot of the company they were pentesting and somebody would always put the thing into a workstation to see what as on it and get p0wned.

Phishing isn't really that different.

Great reminder to setup Passkeys: https://help.x.com/en/managing-your-account/how-to-use-passk...

Aeolun 221 days ago | |

Our company does regular phishing attacks against our own team, which apparently gets us a noteworthy 90% ‘not-click’ rate (don’t quote me on numbers).

Never mind that that 10% is still 1500 people xD

It’s gone so far that they’re now sending them from our internal domains, so when the banner to warn me it was an external email wasn’t there, I also got got.

antonymoose 221 days ago | | |

I used to work for an anti-phishing focused brand protection firm, we provide training and testing to third parties and heavily, aggressively dog-fooded our own products.

So, of course, we got to a point as a company where no one opened any email or clicked any link ever. This caused HR pain every year during open-enrollment season, for other annual trainings, etc.

At one point they started putting “THIS IS NOT A PHISH” in big red letters at the top of the email body to get folks to open emails and handle paperwork.

So then our trainers stole the “NOT A PHISH” header and got almost the entire company with that one email.

solid_fuel 221 days ago | | |

At a previous position, I had a rather strained relationship with the IT department - they were very slow to fill requests and maintained an extremely locked down windows server that we were supposed to develop for. It wasn't the worse environment, but the constant red tape was pretty frustrating.

I got got when they sent out a phishing test email disguised as a survey of user satisfaction with the IT department. Honestly I couldn't even be mad about it - it looked like all those other sketchy corporate surveys complete with a link to a domain similar to Qualtrics (I think it was one or two letters off).

liquidgecka 221 days ago | | |

My former company would send out rewards as a thank you to employees. It was basically a “click here to receive your free gift!” email. I kept telling the security team that this was a TERRIBLE president but it continued none the less. The first time I got one I didn’t open it for ages, even after confirming the company was real. It was only after like the 5th nagging email that I asked security about it and they confirmed that it was in fact a real thing the company was using. I got a roomba, a nice outdoor chair, and some sweet headphones. =)

Spivak 221 days ago | | |

I'm so surprised by this, not because I don't think that many people would fall for a phishing attempt, but because the corporate "training" phishing emails are so glaringly obvious that I think it does a disservice to the people being tested. I feel like it gives a false impression you can detect phishing via vibes when the real ones will be much stealthier.

Are your phishing emails good? If so if you don't mind name dropping the company so I can make a pitch to switch to them.

skeeter2020 221 days ago | | |

>> so when the banner to warn me it was an external email

These are so obviously useless. When the majority of your email has a warning banner it stops to be any sort of warning. It's like being at "code orange" for 20 years after 9/11; no-one maintained "heightened security awareness" for decades, it just became something else to filter.

Amorymeltzer 221 days ago | |

>they'd throw USB sticks in the parking lot of the company they were pentesting and somebody would always put the thing into a workstation to see what as on it and get p0wned.

One of my favorite quotes is from an unnamed architect of the plan in a 2012 article about Stuxnet/the cyber attacks on Iran's nuclear program:

"It turns out there is always an idiot around who doesn't think much about the thumb drive in their hand."

mr_mitm 221 days ago | | |

I don't think we should be calling the users idiots when we failed to make our systems secure by design. If a simple act like plugging in a thumb drive by a well-meaning user undermines the security of an entire operation, then why do we allow such a thing to happen?

Relevant: https://www.schneier.com/blog/archives/2016/10/security_desi...

DamnInteresting 221 days ago | |

Last year I got a phishing email at my work address, and it was more convincing than most. I knew it was phishing, but it might have fooled me if I'd been less attentive.

When I see these sophisticated phishing messages I like to click through and check out how well-made the phishing site itself is, sometimes I fill their form with bogus info to waste their time. So I opened the link in a sandboxed window, looked around, entered nothing into any forms.

It turns out the email was from a pen testing firm my employer had hired, and it had a code baked into the url linked to me. So they reported that I had been successfully phished, even though I never input any data, let alone anything sensitive.

If that's the bar pen testing firms use to say that they've succeeded in phishing, then it's not very useful.

bc569a80a344f9c 221 days ago | | |

I think it's fair to put more (or, maybe, less) nuance on that. Zero-days against browsers exist, zero-days against plugins installed via MDM exist. Sure, you didn't actually submit any credentials, but cybersecurity training and phishing simulations have to target a lowest common denominator: people shouldn't click on links in shady emails. Sometimes just the act of clicking is bad enough. So that's what they base assigning training or a pass/fail on: whether you accessed the pretend TA site, and not whether you hit a submit button there.

For what it's worth, all vendors I've worked with in that space report on both. I'm pretty sure even o365's built-in (and rather crude) tool reports both on "clicked link" and "submitted credentials". I'd estimate it's more likely your employer was able to tell the difference, but didn't both differentiating between the two when assigning follow-up training because just clicking is bad enough.

amenghra 221 days ago | |

If you are getting powned by running random executables found on usb drives, passkeys aren’t going to save you. Same if the social engineering is going to get you to install random executables.

tialaramex 221 days ago | | |

If you're getting pwned a physical Security Key still means bad guys don't have the actual credential (there's no way to get that), and they have to work relatively hard to even create a situation where maybe you to let them use the credential you do have (inside the Security Key) while they're in position to exploit you.

These devices want a physical interaction (this is called "User present") for most operations, typically signified by having a push button or contact sensor, so the attacker needs to have a proof of identity ready to sign, send that over - then persuade the user to push the button or whatever. It's not that difficult but it's one more step and if that doesn't work you wasted your shot.

rm445 221 days ago | | |

I think the claim is that plugging in the USB device is enough. If people needed to try running an executable from the device, some devices would still be compromised, but with lower frequency. I don't know exactly what happens. Automatically-triggered 'driver' install that is actually malware? Presenting as a keyboard and typing commands? Low-level cracks in the OS USB stack?

It feels to me more like OSes ought to be more secure. But USB devices are extremely convenient.

akerl_ 221 days ago | | |

Sure; the fix for that is blocking unexpected USB devices on corporate devices.

bee_rider 221 days ago | | |

I don’t disagree.

But, haven’t there been bugs where operating systems will auto run some executable as soon as the USB is plugged in? So, just to be paranoid, I’d classify just plugging the thing in as “running random executables.” At least as a non-security guy.

I wonder if anyone has tried going to a local staples or bestbuy something, and slipping the person at the register a bribe… “if anyone from so-and-so corp buys a flash drive here, put this one in their bag instead.”

Anyway, best to just put glue in the USB ports I guess.

windward 221 days ago | | |

USB devices can be USB HIDs

dilyevsky 221 days ago | |

The stray USB stick is how Stuxnet allegedly got deployed. Tbh I doubt that works in this day and age.

anonymousiam 221 days ago | | |

What I heard about the Stuxnet attack was different from what you are saying:

The enrichment facility had an air-gapped network, and just like our air-gapped networks, they had security requirements that mandated continuous anti-virus definition updates. The AV updates were brought in on a USB thumb drive that had been infected, because it WASN'T air-gapped when the updates were loaded. Obviously their AV tools didn't detect Stuxnet, because it was a state-sponsored, targeted attack, and not in the AV definition database.

So they were a victim of their own security policies, which were very effectively exploited.

roblabla 221 days ago | | |

A USB can pretend to be just about any type of device to get the appropriate driver installed and loaded. They can then send malformed packets to that driver to trigger some vulnerability and take over the system.

There are a _lot_ of drivers for devices on a default windows install. There are a _lot more_ if you allow for Windows Update to install drivers for devices (which it does by default). I would not trust all of them to be secure against a malicious device.

I know this is not how stuxxnet worked (instead using a vulnerability in how LNK files were shown in explorer.exe as the exploit), but that just goes to show how much surface there is to attack using this kind of USB stick.

And yeah, people still routinely plug random USBs in their computers. The average person is simultaneously curious and oblivious to this kind of threat (and I don't blame them - this kind of threat is hard to explain to a lay person).

EvanAnderson 221 days ago | | |

Stuxnet deployment wasn't just a USB stick, though. It was a USB stick w/ a zero-day in the Windows shell for handling LNK files to get arbitrary code execution. That's not to say that random thumb drives being plugged-in by users is good, but Stuxnet deployment was a more sophisticated attack than just relying on the user to run a program.

(They will run programs, though. They always do.)

FreakLegion 221 days ago | | |

Versions of it work necessarily. The gist is that the USB device presents as a keyboard and is pre-programmed to pop a shell and start blasting. No exploits required. See: https://en.wikipedia.org/wiki/BadUSB.

stavros 221 days ago | | |

Hah, watch me.

frosting1337 221 days ago | | |

It does work.

danpalmer 221 days ago | |

I've seen someone do a live, on stage demo of phishing audit software, where they phished a real company, and showed what happens when someone falls for it.

Live. On stage. In minutes. People fall for it so reliably that you can do that.

When we ran it we got fake vouchers for "cost coffee" with a redeem link, new negative reviews of the company on "trustplot" with a reply link, and abnormal activity on your "whatapp" with a map of Russia, and a report link. They were exceptionally successful even despite the silly names.

KingOfCoders 221 days ago | |

Once a head of security worked for me (CTO), and she was great great great. She did the same, putting USB sticks on the printers for example and see who would plug one into their computer.

croes 221 days ago | |

But don’t use the passkey feature of your smartphone.

They have no import/export so you are stuck in the iOS/Android ecosystem or have to do the passkey setup for all pages all over again

kstenerud 221 days ago | |

These audits are infuriating. At one company I was at it got so bad that I eventually stopped reading email and told people "If it's important, ping me on Slack"

stavros 221 days ago |

Ever since I almost got phished (wasn't looking closely enough at the domain to notice a little stress mark over the "s" in the domain name, thankfully I was using a hardware wallet that prevented the attack entirely), I realized that anyone can get phished. They just rely on you being busy, or out, or tired, and just not checking closely enough.

Use passkeys for everything, like Thomas says.

pants2 221 days ago |

This "content violation on your X post" phishing email is so common, we get about a dozen of those a week, and had to change the filters many times to catch them (because it's not easy to just detect the letter X and they keep changing the wording).

We also ended up dropping our email security provider because they consistently missed these. We evaluated/trialed almost a dozen different providers and finally found one that did detect every X phishing email! (Check Point fyi, not affiliated)

It was actually embarrassing for most of those security companies because the signs of phishing are very obvious if you look.

pixl97 220 days ago | |

It easy to block all phishing email. Just block all email.

It's much much harder to block emails that aren't actually phishing but have components that would flag them anyway.

grinich 221 days ago |

I got hit with the same kind of phishing attack a couple months ago

It's pretty incredible the level of UI engineering that went into it.

Some screenshots I took: https://x.com/grinich/status/1963744947053703309

fschuett 221 days ago | |

Hmm, since Chromium is working on adding browser-local AI features, I wonder if this one day could be a security check (for links opened from the outside of the browser). E.g. the browser detected that you clicked on a new-tab link, and the page looks like a commonly known site, then the AI detects that the URL isn't "x.com" and gives a heads-up warning. At least for the top 1000 most common sites, this could prevent a lot of phishing attacks.

giarc 221 days ago | |

I'm sorry but the imagecontent-x.com url should throw red flags for anyone.

tptacek 221 days ago | | |

This is exactly how not to defend against phishing. The meaningful defense is to foreclose on it entirely, not to just get super good at spotting fakes.

everybodyknows 221 days ago | |

So, in that case the browser (correctly) did not autofill? Is that a common occurrence for legit traffic from X? And no complaint about the website's identity from the browser -- the expected "lock" icon left of the URL?

9dev 221 days ago | | |

As long as people are used to companies just buying new domains for the hell of it, yes. Just look at the amount of domains Microsoft uses for signing in! My password manager currently holds 8 of them. Eight! Who can be blamed for thinking it’s the password managers fault?

__jonas 221 days ago |

That's some impressive work on the attackers part having that whole fake landing page ready to go, and a pretty convincing phishing email.

I'm don't know much about crypto so I'm not sure what makes them call the scam 'not very plausible' and say it 'probably generated $0 for the attackers', is that something that can be verified by checking the wallet used in that fake landing page?

tgsovlerkhgsel 221 days ago |

This is why properly working password managers are important, and why as a web site operator you should make sure to not break them. My password not auto-filling on a web site is a sufficient red flag to immediately become very watchful.

Code-based 2FA, on the other hand, is completely useless against phishing. If I'm logging in, I'm logging in, and you're getting my 2FA code (regardless of whether it's coming from an SMS or an app).

nialv7 221 days ago | |

the creator of https://haveibeenpwned.com got phished once (no kidding), and he uses a password manager.

phsau 221 days ago | | |

And if you read the story, it's because he ignored the fact that the password manager didn't prompt auto-fill.

"I went to the link which is on mailchimp-sso.com and entered my credentials which - crucially - did not auto-complete from 1Password. I then entered the OTP and the page hung. Moments later, the penny dropped, and I logged onto the official website, which Mailchimp confirmed via a notification email which showed my London IP address:"

akerl_ 221 days ago | |

How does this square with the fact that the tech savvy person in the post was phished despite using a password manager.

KingOfCoders 221 days ago |

Phishing training does not work.

"Understanding the Efficacy of Phishing Training in Practice" https://arianamirian.com/docs/ieee-25.pdf

karel-3d 221 days ago | |

"Don't put your password into the website that you shouldn't and put it only to website that you should" is a circular advice.

It's like those 2FA SMS that say "don't tell this token to anyone!" while you literally share it with the website that you login to. I am always so frustrated when I receive those

classified 221 days ago | |

> We are reliably informed by our zoomer children that we are too cringe to be trusted on these matters.

Bullseye. At least they take it with good humor.

man8alexd 221 days ago | |

The same paper is linked in the original article.

KingOfCoders 221 days ago | | |

Thanks. Stopped reading after I found out the article was not by the CEO.

ctennis1 221 days ago | |

Maybe not - but I work in a regulated industry, we had an employee get phished a few years ago, and the regulatory bodies wanted detailed records of all phishing testing and training conducted for the previous 5 years. So for some of us it's a necessary evil.

roughly 221 days ago |

I was reading this and wondering why it was posted so high (I didn’t recognize the company name), and then I got to the name at the bottom. I think the lesson here is “if it could happen to Kurt, it could happen to anyone.” Yeah, the consequences here were pretty limited, but everyone’s got Some vulnerability, and it’s usually in the junk pile in the corner that you’re ignoring. If the attacker were genuinely trying to do damage (as opposed to just running a two-bit crypto scam), assuming the company’s official account is a fine start to leverage for some social engineering.

akerl_ 221 days ago | |

I think you mean Kurt.

stavros 221 days ago | | |

It would help if they mentioned his name anywhere in the post, title, or subtitle.

roughly 221 days ago | | |

You’re right - I flagged on Thomas’s name in the signature and because I’ve seen him around here, well, forever, but Kurt is also extremely savvy.

herval 221 days ago |

Great writeup, but also gotta say that’s some excellent phishing

tptacek 221 days ago | |

This exact phish has been going around lately and we're not the only ones who got bit. But we didn't know that before it happened.

ChrisMarshallNY 221 days ago | |

I enjoyed the self-deprecating humor behind it.

I have been almost got, a couple of times. I'm not sure, but I may have realized that I got got, about 0.5 seconds after clicking[0], and was able to lock down, before they were able to grab it.

[0] https://imgur.com/EfQrdWY

silexia 221 days ago |

CEO here, I also almost got taken by a fake legal notice about a Facebook post. My password manager would not auto enter my password so I tried manually entering it like a dummy. Fortunately, it was the wrong one.

latchkey 221 days ago | |

This is exactly why I turned off auto enter.

akerl_ 221 days ago | | |

Isn’t turning off auto enter exacerbating the problem?

The avenue for catching this is that the password manager’s autofill won’t work on the phishing site, and the user could notice that and catch that it’s a malicious domain

OkayPhysicist 221 days ago | | |

No, that's the opposite of the moral of that story. If the person you responded to had listened to the fact that the auto-enter didn't auto-enter, they wouldn't have been at any risk. Likewise in the article, the problem was that the CEO copy-pasted the password into the phishing page's password field, NOT that the auto-enter prompted him to do so.

deepfriedrice 221 days ago |

I don't know the gullibility of the average tech CEO but this doesn't strike me as a very convincing phishing attempt.

* "We've received reports about the latest content" - weird copy

* "which doesn't meet X Terms of Service" - bad grammar lol

* "Important:Simply ..." - no spacing lol

* "Simply removing the content from your page doesn't help your case" - weird tone

* "We've opened a support portal for you " - weird copy

There should so many red flags here if you're a native english speaker.

There are some UX red flags as well, but I admit those are much less noticeable.

* Weird and inconsistent font size/weight

* Massive border radius on the twitter card image (lol)

* Gap sizes are weird/small

* Weird CTA

akerl_ 221 days ago | |

I think you'll be led astray thinking this is CEO-specific.

The whole theory of phishing, and especially targeted phishing, is to present a scenario that tricks the user into ignoring the red flags. Usually, this is an urgent call to action that something negative will happen, coupled with a tie-in to something that seems legit. In this case, it was referencing a real post that the company had made.

A parallel example is when parents get phone calls saying "hey it's your kid, I took a surprise trip to a tiny island nation and I've been kidnapped, I need you to wire $1000 immediately or they're going to kill me". That interaction is full of red flags, but the psychological hit is massive and people pay out all the time.

deepfriedrice 221 days ago | | |

I razz CEOs in jest, but my point is: This is an example of a good phishing attempt? ChatGPT could surely find and fix most of the red flags I called out. Perhaps the red flags ensure they don't phish more people than they can productively exploit.

chews 221 days ago |

if anyone @ x.com infosec is here, my buddy got her account phished / there is someone in CS selling creds. Then it was used to pump a crypto scam and she has been trying for months to get it sorted. She's had the account for 16 plus years, it's surprising it's this hard to fix.

It's x.com/leighleighsf, we've tried every channel but for filing a small claims lawsuit in Texas to get her account back.

zahlman 221 days ago |

> Had this been an impactful attack, we would not be this flippant about it. For this, though, any other tone on our part would be false.

> ...

> If you were inclined to take us up on an “airdrop” to “claim a share” of the “token” powering Fly.io, the site is still up. You can connect your wallet it [sic] it! You’ll lose all your money. But if we’d actually done an ICO, you’d have lost all your money anyways.

> Somebody involved in pulling this attack off had to come up with “own a piece of the sky!”, and I think that’s punishment enough for them.

I was amused by all of this, but I still feel like they should care more about how impactful this was for anyone who got crypto-scammed at the link. I mean, yes, those are people who would believe the story and also click a link like that. But what if fly.io were found to share liability?

siskiyou 221 days ago |

The part I found surprising: 'Twitter fell outside the “things we take seriously” boundary'

Sure Twitter is rubbish, but it's still a huge platform, still tied to your brand, you're still using it, so it can still hurt you. Either take it seriously or stop using it.

tptacek 221 days ago | |

Before the Twitter Change of Control, we were actively using it. After, it fell into a kind of limbo. There was a solid 6 months or so when we thought maybe we were just going to do everything via our Hachyderm account. Shit's complicated. And if we'd stopped using it altogether, we'd still be in the same boat!

siskiyou 220 days ago | | |

Thanks for your answer. I get it, you're people, it's a mistake, it's not the most horrible thing ever, but a simple "oops my bad" would have been a shorter blog post. Would you really have been in the same boat if the tweet shown mentioned in the phishing effort had never been posted, or did the phisher fabricate that entirely?

loloquwowndueo 221 days ago | |

You mean X, right? Sounds like neither them nor you take it seriously :)

siskiyou 220 days ago | | |

(Turning up my hearing aids) that's right mate

tptacek 221 days ago |

I want to say again that the key thing in this post is that anything "serious" at Fly.io couldn't have gotten phished: your SSO login won't work if you don't have mandatory phish-resistant 2FA set up for it. What went wrong here is that Twitter wasn't behind that perimeter, because, well, we have trouble taking Twitter seriously.

We shouldn't have, and we do take it seriously now.

breakingcups 221 days ago | |

I will say that a "Critical Security Vulnerability in flyctl, update now: https://bad-link/to/update.zip" tweet will have very serious consequences for a portion of your userbase, despite not directly compromising your own infra.

tptacek 221 days ago | | |

You could do that yourself today by getting a blue-checked @realFlyDotIo. But there's a paragraph in the article about this, and we know what we would have done had there been any signs of direct attacks on our users.

latchkey 221 days ago | |

[deleted]

tptacek 221 days ago | | |

Twitter isn't an operational dependency of ours and we don't attest to it at all. It also doesn't require we do that: what SOC2 actually demands of vendor security practices is much more complicated (and performative) than that. If Twitter were a real vendor dependency of ours, most of what we'd need would be a SOC2 attestation from them.

black_puppydog 221 days ago |

Kudos to Thomas and whoever else contributed here, the writing is great! <3

rtpg 221 days ago |

Fly has consistently surprised me at how late they have been to doing the "standard company" stuff. Their sort of lack of support engineering teams for a while affected me way more though.

You gotta take the Legos away from the CEO! Being CEO means you stop doing the other stuff! Sorry!

And yes they have their silly disclaimer on their blog, but this is Yet Another "oh lol we made a whoopsie" tone that they've taken in the past several times for "real" issues. My favorite being "we did a thing, you should have read the forums where we posted about it, but clearly some of you didn't". You have my e-mail address!

Please.... please... get real comms. I'm tired of the "oh lol we're just doing shit" vibes from the only place I can _barely_ recommend as an alternative to Heroku. I don't need the cuteness. And 60% of that is because one of your main competitors has a totally unsearchable name.

Still using fly, just annoyed.

foxglacier 221 days ago |

Like with occupational safety, we should worry about near misses as well as actual hacks. If you realize you just logged into X from a link in an email, you should berate yourself for could-have-been-hacked. Never enter credentials into links from emails!

vednig 221 days ago |

Irony would be if we found out the hackers ran their website on fly.io that would be a swell

lawik 221 days ago |

Funny!

Now that Kurt doesn't have commit access, who do I ask to get internal Fly Slack bot fizz off of my behind.

I was in a devrel channel for a short while and ever since it has asked me to write updates in a channel I don't have access to. Frequently.

reassess_blind 221 days ago |

Is there an anti-phishing extension that detects whether the domain is close to, but not exactly the popular legitimate domain? Would probably need to use a local LLM for the detection. If not I might look into making one.

haruka_ff 221 days ago | |

MetaMask (the crypto wallet) has one that shows warning pages to all domains that are remotely similar to crypto-related domains, and it is very prone to false positives and annoying. They have to maintain a list to skip the detection for real domains, and it's really inefficient.

Feels like this kind of detection is hard to balance, and calling legit websites possible phishing might be problematic...

reassess_blind 221 days ago | | |

Seems like the kind of problem LLMs would be perfect for. ChatGPT does a great job at giving a score of whether domains are attempting to appear legitimate, but of course no one wants their browsing history being sent off to OpenAI. Unfortunately from my testing local 4B-7B LLMs aren't up to the task.

typpilol 221 days ago | |

Edge has some basic typo squat protection

jryio 221 days ago |

I'm always glad to see when companies, developers and CEOs make a heartfelt and humanistic mae culpa.

We would like to think that we're the smart ones and above such low level types of exploits, but the reality is that they can catch us at any moment on a good or bad day.

Good write up

000ooo000 221 days ago | |

>heartfelt and humanistic mae culpa

They literally admit they pay a Zoomer to make memes for Twitter. I think you are falling for the PR.

mrkurt 220 days ago | | |

I am confused. Are we not supposed to pay zoomers.

x0x0 221 days ago |

... could we get webauthn / yubikeys prioritized for fly? afaik (don't want to disable 2fa to find out), it only supports totp.

For everyone reading though, you should try fly. Unaffiliated except for being a happy customer. 50 lines of toml is so so much better than 1k+ lines of cloudformation.

tptacek 221 days ago | |

We don't like TOTP, at all, for reasons even more obvious now, but our standard answer for advanced MFA has been OIDC, which is what most people should do rather than setting up bespoke U2F/FIDO2/Passkeys.

We will get to this though.

https://fly.io/blog/tokenized-tokens/

parliament32 221 days ago | | |

That would be great, but

> Fly.io supports Google and GitHub as Identity Providers[1]

How about you just support SAML like a real enterprise vendor, so IdP-specific support isn't your problem anymore? I get it, SAML is hard, but it's really the One True Path when it comes to this stuff.

[1] https://fly.io/docs/security/sso/

classified 221 days ago |

X Terms of Service error: Meme not dank enough.

0xdeadbeefbabe 221 days ago |

Huh, so I'm stupid I guess, but how is MFA phish proof? Why did Kurt's commit access get revoked?

tptacek 221 days ago | |

The commit access thing is a joke. I think it's a joke. It's mostly a joke.

MFA is not in general phish-resistant. But Passkeys, U2F, and FIDO2 generally are, because they mutually authenticate; they're not just "one time passwords" you type into a field, but rather a cryptographic protocol running between you and the site.

0xdeadbeefbabe 220 days ago | | |

Well he must be punished somehow!

kwar13 221 days ago |

That was beautiful to read. lol.

IG_Semmelweiss 221 days ago | |

Dank post mortem ?

KingOfCoders 221 days ago |

[Deleted]

theturtle 221 days ago |

[flagged]

tomhow 221 days ago | |

We've banned this account.

nofriend 221 days ago |

> But if we’d actually done an ICO, you’d have lost all your money anyways.

tru tru

paxys 221 days ago |

> This is, in fact, how all of our infrastructure is secured at Fly.io; specifically, we get everything behind an IdP (in our case: Google’s) and have it require phishing-proof MFA.

Every system is only as secure as its weakest link. If the company's CEO is idiotic enough to pull credentials from 1Password and manually copy-past them on a random website whose domain does not match the service that issued it, what is to say they won't do the same for an MFA token?

roblabla 221 days ago | |

They literally explain in the article they're using FIDO MFA that is phishing proof as the key authenticates the website (it's not your run-of-the-mill sms 2FA, it's using WebAuthn to talk to your MFA).

With this setup, you can't fuck up.

akerl_ 221 days ago | |

FIDO2 won’t send an authentication to a fake site, no matter what the human does.

That’s what makes it phishing-resistant.

parliament32 221 days ago | |

Passkeys are called "phishing-resistant" because (when properly implemented) it's impossible for users to fuck up. They literally cannot be phished into giving an adversary their credentials, no matter what they click or what they do.

tptacek 221 days ago | |

The. whole. point. of. phishing-resistant. MFA. is. that. you. can't. do. the. same. thing.

lijok 221 days ago |

This makes fly.io seem like an unserious business. I was under the impression they were trying to build something of substance.

dyauspitr 221 days ago |

When did fly.io create their own crypto?

ezfe 221 days ago | |

They didn't...?

dyauspitr 221 days ago | | |

The first line of this article is talking about the $FLY token