undefined | Better HN

0 pointsjameshart1y ago0 comments

Solvable with the right information in the authorizing email.

Remember that the flow the magic link is part of is one you initiate, that causes you to get an email you are expecting.

That email, and the landing and confirmation page it links you to, can explain very clearly that you are only supposed to authorize this if you are trying to log in on known device in known location that is displaying recognizable number on the screen right now.

0 comments

avidiax1y ago

Rather than a recognizable number, users should be prompted to select a matching non-pronounceable glyph. Something like the keypads from KTANE [1].

That makes it impossible to text or speak it to a phisher.

Bonus points if you show the symbol as a noisy animated glyph, something like [2], or a link to a DRM'd video showing a symbol. That would make it very difficult to view even with screen recording or remote desktop software.

[1] https://www.bombmanual.com/web/index.html#:~:text=On%20the%2...

[2] https://www.youtube.com/watch?v=RNhiT-SmR1Q

layer81y ago

There is a substantial class of users this would be too much to ask of, i.e. they wouldn’t understand it or would assume that they are being scammed somehow.

Jerrrry1y ago

The thought of using unpronounceable text to deter phishing attempts reminds me of putting illegible Unicode as challenge question answers to prevent the CSR from giving an account away to convincing social engineers.

forgotusername61y ago

And then when you need to provide an accessible version?

Mystery-Machine1y ago

You're assuming users read.

michaelmior1y ago

> the flow the magic link is part of is one you initiate

There's nothing stopping anyone else from initiating the flow assuming the common implementation where only an email is required to initiate sending the link.

jameshartOP1y ago

Yes and when you receive an email saying

Here is the link you requested from ‘Android Device’ in ‘Belarus’ - click here to sign in and allow that device to access your account - only click this if you requested this email

You don’t click the link if you didn’t request it.

jonplackett1y ago

You might not. Your granny? Maybe.

lcnPylGDnU4H9OF1y ago

The phisher will be on the phone with their victim, pretending to be a support agent for the business. They will say, "Yes click the link, that's how you verify with us."

1 more reply

j / k navigate · click thread line to collapse