Had a message from Amazon

That's worrying but could the user achieve the same result by over-enthusiastic use of cleaning software such as CCleaner?

I got one claiming someone had ordered a gift voucher for £49.99 and did I want to cancel it. I kept the caller on for a long time debating first whether it was possible to buy a £49.99 gift voucher then telling her not to cancel it but to send it to me as it would be useful for the next birthday present.

The user is more likely to achieve the opposite i.e. they close the session and need to sign-in again.

That would just log them out of their session.

The way 2FA access to a web page typically works, is you sign in and jump through the 2FA hoop. However since it would be unusable if you have to re-do 2FA for every further click on the web site, there needs to be a way for the user's browser session to "persist" that authentication.

So typically once authenticated, an access token is dropped onto the machine to allow further interactions without needing to re-authenticate. Sometimes this can be for a limited period of time (hours, days etc) or it might semi permanent "Don't ask for this machine again" - until you explicitly log out again.

That is fine so long as the local platform has not been compromised in such a way that a bad actor can steal those authentication tokens, then install them on a machine they control, and then "inherit" your logged in session.

Surely the cookie/token/whatever should make sure that it's on the machine that it thinks it's on. Certainly 'persistent' authentication (so that you don't have to repeat 2FA or something else) for such as PayPal and one bank that I use does something of the sort.

It's hard to do that in general terms. For example you login to their website on your phone, using your home wifi. Then you get in a taxi and use LTE data for a bit. Then you get out of the taxi and connect to the wifi at the coffee shop. Your IP address changes while your session is in progress, and that can also throw geolocation.

There are certain heuristics about 'is this the same kind of machine you logged in from before' (based on browser, OS, window size and other metrics) but I'd assume the cookie-stealing attacker can spoof those.

Theo

Disk drive ID should be unique and pretty well impossible to guess. It won't work on a 'phone I suppose but most other sorts of machines will have a device for which it works.

It's well documented too so should be easy enough to use. I have always assumed that's what these systems are doing.

Though, on thinking about it, I suppose a web app can't get at things like disk drives.

Why is this not all handled on the host side? Which can then decide whether to

Exactly!

Indeed, and there's a whole other counter-force which is fingerprinting. The ad industry (and other more nefarious types - think dubious regimes) would really love that they can identify individual users no matter what anonymisation they use, which is why browsers put a lot of effort into stripping out identifying information[1]. Unfortunately that's exactly the same process by which a website might try to identify you for legitimate purposes.

Theo

More to the point, if the attacker has a way to exfiltrate data from your machine, they can also exfiltrate many of the other "unique" bits of information that the defender may choose to use as "proof" that the right machine is doing the access.

Remember that the web is mostly "stateless" - the web server does not have much concept of a session as such, so it relies on the client end to maintain the semblance of a session. Either by storing and returning cookies, or passing stuff back via "fat" urls.

But the 2FA process only kicks in once I've supplied what I claim to be my username/password. That is the point at which the back-end software, on the server, should say, hmmm, he logged in from a UK IP address not 2 hours ago, here he is claiming to be logging in again from Honolulu. Better 2FA the bastard!

Thanks folks, a lot of useful info onboard.

A virtual machine per use seems sensible ...

Are you sure it came from Amazon?

Did you click on any links?

Assuming the refund was made (and assuming the poster has checked) then it would seem highly unlikely that any scammer would transfer £70 INTO someone's account. They can 'scam' me in that manner anytime they want.

That assumes that money was actually taken from the OP's account and then refunded.

I still wonder if it was a phishing exercise whereby the scammers were hoping that the OP would check his bank account and seeing no money taken/refunded would then click on a link in the email to report it which would lead to a bogus Amazon site which would ask the OP to update passwords and confirm bank details.

After that the scammers would clear out his bank account.