18
2FA alone does not help in this scenario. If the 2FA input screen on bank.com does not have other protections, like TLS, pinning/HSTS, MITM protection, and/or verify the client or detect login anomalies, then there is a vulnerability.
This is a case where an integrated password manager in the browser can help the end-user, by not providing the credentials to ...
12
Security keys like yubikey, titankey, nitrokey, and solokey use the U2F protocol, which is immune to phishing by mixing the domain into the nonce. In order for this to happen, the attacker would have to have control of the domain. And if you're talking about a browser, they are configured to also require the page to be a valid HTTPS connection. Meaning the ...
3
Going into incorrect URLs would of course pose a risk even with 2FA. You correctly identified that. 2FA is aimed more towards leaked passwords for the correct URL. There will always be risks where human naivety is concerned, so providing people check the URLs, in most scenarios 2FA does help.
2
It reduces the window in which an attack may be carried
Consider the case where the connection does not have 2FA, only user and password. The victim provided his bank credentials and doesn't even realize it was a phishing after the fact. The attacker can later use them to log in as the user and empty the account. Perhaps during the night, when the user is ...
Only top voted, non community-wiki answers of a minimum length are eligible
