Behold, the Facebook phishing scam that could dupe even vigilant users

Websites that dont want to bother creating and securing password-based authentication systems need only access an easy-to-use programming interface. Security and cryptographic mechanisms under the hood allow the login to happen without the third-party site ever seeing the username and password.

EnlargeOne of the ingredients that made the login window look so real is that it almost perfectly reproduced what users would see if they were encountering a genuine Facebook SSO, such as the one to the right of this text.

Genuine SSOs from Facebook and Google can be dragged outside of the window of the third-party site without any part of the login prompt disappearing.

A password phished from a Facebook account that used MFA protection would have been of little use to attackers since they wouldnt have had the physical key or smartphone thats required when logging in from a computer that has never accessed the account before.