Modlishka

I remember some big service many years ago (maybe yahoo?) had a “memorable image” or something that was associated with your username as some kind of anti phish metric. Of course nowadays that would be trivial to bypass with something like Modliskha or a different reverse proxy passing through the website content. https://github.com/drk1wi/Modlishka

Thanks for posting! While this might be common knowledge on this forum (is it?!), many users are unaware that even having 2FA does not protect them against credential theft via phishing. Such attacks are growing rapidly given recent exploit kits for OTP-based 2FA that are publicly available on Github (https://github.com/drk1wi/Modlishka). PhishAR prevents such attacks by requiring that the visited domain and SSL are first checked by the user's app and only then revealing the OTP. Any feedback would be very helpful. We are aiming at enterprise users where getting everyone to use FIDO U2F might be harder to achieve, but 2FA is mandatory (e.g. due to GDPR). What do you think? Let us know if you would be happy testing the app once we get it a bit more polished.