How deeply does Real-World Cryptography cover phishing?

Explains the definition and a phone-based OTP scenario but stops short of a defensive procedure.

Phishing

Phishing is a social-engineering attack that persuades a person to disclose authentication information or perform an unsafe action.

Phishing, also called social engineering, attacks human judgment rather than software vulnerabilities. It persuades someone to disclose authentication information or perform an unsafe action. section 11.2.3

The urgent OTP call

An attacker starts logging in as you and waits for the application to request a one-time password. Then the attacker calls, pretends to work for the application, invents a believable story, and creates urgency so you reveal the valid code. section 11.2.3

Phishing remains effective because it exploits ordinary human pressures:

A convincing story can make an attacker appear trustworthy. section 11.2.3
A fabricated sense of urgency can push people to disclose authentication information. section 11.2.3
Protocols previously discussed, including one-time-password authentication, remain vulnerable when people are persuaded to hand over their secrets. section 11.2.3

How Real-World Cryptography covers it

liveBook manning.com

Read Real-World Cryptography on liveBook Get the book at manning.com

Also explained in

liveBook manning.com

Software Security for DevelopersA phishing attack is a social-engineering attack that impersonates a trusted party to trick a person into disclosing information or performing an unauthorized action.
liveBook manning.com

Data-Driven CybersecurityA phishing attack deceives targets into disclosing information, executing actions, or providing access by impersonating a trusted source.
liveBook manning.com

Acing the CCNA Exam: Volume 2 Advanced Networking and SecurityPhishing is a social engineering technique that uses deceptive messages or sites to trick targets into revealing information, clicking malicious links, or downloading malware.
liveBook manning.com

AI for Everyday ITPhishing is a deceptive attempt to obtain information or induce harmful actions by impersonating a trustworthy sender or service.

Compare how 5 books explain phishing →

Related concepts

attack vectorkind of · An attack vector is a path, method, or mechanism through which an adversary can reach a target or carry out an attack.
social engineeringkind of · Social engineering is the manipulation of people through deception, persuasion, or other social tactics to induce disclosure, access, or actions that may compromise security.
spear phishingincludes · Spear phishing is a targeted phishing attack that uses personalized information or messages to deceive a specific individual or small group.
security trainingused by · Security training is structured education that develops people’s knowledge and behaviors for recognizing threats and protecting systems, software, and information.
passkeyaddressed by · A passkey is a passwordless, phishing-resistant authentication credential based on a public-key cryptographic pair and protected by an authenticator.

This explainer was generated by Manning's knowledge graph from the text of Real-World Cryptography. The section links point to the parts of the book it draws on.