3 ms·

To stop being phished always check the domain name and for HTTPS before entering passwords.

• mderazon 10y ago
  Don't trust HTTPS, any malicious site can get certificate very easily. I once almost fell for a smart Airbnb phishing attack. At some point, I was directed to https://www.airbnb.com.eubook.net/en/instant/rooms/2685603?checkin=08%2F26%2F2016&checkout=08%2F31%2F2016&currency=€&guests=10 https://www.airbnb.com.eubook.net/en/instant/rooms/2685603?c... to complete my booking. Website had perfectly valid SSL cert (doesn't anymore) and more importantly, check out the domain name ! Almost missed the .eubook.net part!
  • JorgeGT 10y ago
    HTTPS only means "you are securely accessing this particular domain" not "the operators of this domain are nice people".
  • rvern 10y ago
    That's why witty_username said to check the domain name and for HTTPS, not just for HTTPS.
• abecedarius 10y ago
  My policy is to enter it myself, maybe with help from address bar autocomplete or Google. Perhaps I should make my own portal page instead. (The exception is some sites like Amazon that prompt for a password on certain actions. I wonder if I should worry about something weird happening like a tab left alone a long time impersonating Amazon when I get back to it.)