4 ms·
> Over the years, many users have learned to "look for the padlock" before entering their passwords. This is - unfortunately - bad advice. The padlock tells yo
by hannob 10y ago
> Over the years, many users have learned to "look for the padlock" before entering their passwords.
This is - unfortunately - bad advice. The padlock tells you that you're on the site that you are. But it doesn't tell you anything about the trustworthiness of the site.
If you're at https://evilhacker.com https://evilhacker.com and you enter your password then evilhacker will get your password.
- phlo 10y agoAbsolutely. Which is why I think we still have a lot of work ahead of us, making users actually check the domain name, and the validated identity (for EV certs).
- afarrell 10y agoHaving them use a passsword manager is a better apporach. Checking the domain name is weak to keming probiems.
- phlo 10y ago...and password managers are weak to lots of problems [1], the least of which is malware stealing your password container plus the master key [2]. I'm still leaning towards the password manager side of the dilemma, but the situation isn't great on either. [1] https://twitter.com/taviso/status/769378052254015488 https://twitter.com/taviso/status/769378052254015488 [2] http://arstechnica.com/security/2014/11/citadel-attackers-aim-to-steal-victims-master-passwords/ http://arstechnica.com/security/2014/11/citadel-attackers-ai...