css-only-chat VS evilginx2

The idea of using CSS-triggered requests for analytics was really cool to me when I first encountered it.

One guy on twitter (no longer available) used it for mouse tracking: overlay an invisible grid of squares on the page, each with a unique background image triggered on hover. Each background image sends a specific request to the server, which interprets it!

For fun one summer, I extended that idea to create a JS-free "css only async web chat": https://github.com/kkuchta/css-only-chat

Isn't CSS Turing complete? Someone even implemented a chat client in it: https://github.com/kkuchta/css-only-chat

If it's something like a new reply to an issue raised, then you can either have it so these only show when the page reloads. Depending on how critical these notifications are, probably not the best solution. An alternative is to have a page that never stops loading. I've never actually used this approach, but I remember this guy used the approach for a JS-free chat system: https://github.com/kkuchta/css-only-chat

Here's an actual CSS-only implementation of a chat app that I happened to stumble across yesterday while tinkering: https://github.com/kkuchta/css-only-chat

No, if you break into a site using passkeys, it gives you literally zero information that can be used to authenticate as any of the users. Think about the prevalence of data breaches in the past decade, and the sharp rise in the effectiveness of password stuffing, and think about why this change might be a good idea.

Also even with traditional 2FA, TOTP can be phished. See https://github.com/kgretzky/evilginx2

WebAuthn almost entirely eliminates phishing risk, and Passkeys are a really nice, clean UX for using WebAuthn.

So I downloaded this onto my computer https://github.com/kgretzky/evilginx2 and that took while since I’m new to GitHub and I barely know my way around computers. That went fine, i noticed there was another repository that was pretty much an add on to that same software I downloaded earlier “evilginx2” by another creator, this is the link https://github.com/simplerhacking/Evilginx3-Phishlets

Did your friend clicked on a phising link, if yes a aitm coud be one of the possibilities: https://github.com/kgretzky/evilginx2

We had a user compromised simiarly the other day, with what I believe to be https://github.com/kgretzky/evilginx2 now. It stole his session cookie and was able to auth. Fortunately, we have Office 365 Defender and he was flagged immediately on the risky user sign-ins and we were able to block and investigate.

Evilginx kan bypass MFA and hijack your session https://github.com/kgretzky/evilginx2 Only thing that migitates this is fido keys

You can try this for web app traffic MIMD: https://github.com/kgretzky/evilginx2