6 ms·

The only two things that I think could have prevented me from falling for this is: I don't have images loaded by default for unknown senders, and LastPass would

• caleblloyd 10y ago
  Password managers really shine at times like these. It's especially helpful if when using complicated auto-generated passwords. That way you don't readily "know" your password so the first thing you do is look to autofill. It's still a good idea to have an analog backup of really important passwords. Like if you use Gmail and it is the password reset email for everything else, print out the generated password and put it somewhere safe. Just incase your password manager becomes insolvent one day.
  • chki 10y ago
    I would argue that it is probably a good idea to print out all your passwords every month or so as there is not much risk attached to it (thieves do not usually look for these things).
  • unholiness 10y ago
    > Password managers really shine at times like these I agree on some levels, but password managers can and have had vulnerabilities[0] that can allow the gmail password to be populated despite the wrong domain. Given that the autofill adds legitimacy and reduces friction, it could make this particular scenario go from bad to worse. [0] https://labs.detectify.com/2016/07/27/how-i-made-lastpass-give-me-all-your-passwords/ https://labs.detectify.com/2016/07/27/how-i-made-lastpass-gi...
• mike-cardwell 10y ago
  "I don't have images loaded by default for unknown senders" Does this just prevent the display of images which require fetching from a remote URL, or does it also include images which are embedded in the email as attachments?
  • Tepix 10y ago
    It does not prevent this if the image is attached to the mail.
  • hobarrera 10y ago
    Aside from the fact that this was not an external image, it was also emails to him by a friend.
  • eridius 10y ago
    An even more common way of making it load without causing the email to look like it has an attachment is to embed the image as a data: URI in an <img> tag. Since it's not remote, it will be loaded, but since it's not an attachment, your email client won't show it in the attachments list.
• murkle 10y ago
  The Twitter thread says the image is embedded so I guess will still show?
• TillE 10y ago
  Right, I almost never manually enter passwords on the web. If LastPass isn't automatically filling the field, something is very wrong. It's a nice extra security check, in addition to the primary benefits of using a password manager.
• Jarwain 10y ago
  Assuming the attack is the same as what jhardcastle experienced, the email is propagated by sending emails to those who have received emails from the victim before. Alternately, it would be a known sender sending you that email.
• pasta 10y ago
  This is the reason why I convert all incoming to plain text. It saved me from trackers and fishers so many times.
• Ajedi32 10y ago
  In my case, I likely would have noticed that: 1. The download link didn't show any hover effect when I moused over it 2. Google is asking me to sign in even though I was obviously already authenticated 3. Even if at this point I didn't think to glance at the URL bar and actually entered my password into the phishing page, U2F would save me from being fully compromised