2 ms·

Hmm, I think I've already developed habits that offer me SOME immunity to this. I keep my main gmail in the leftmost tab, Almost always logged in. When I have t

by indrax 16y ago

Hmm, I think I've already developed habits that offer me SOME immunity to this. I keep my main gmail in the leftmost tab, Almost always logged in. When I have tabs for gmail or Google docs that show me being logged-out, I hit reload. Rarely would I log in a second time if I know I'm logged in. Other google services like adsense require password confirmation even when logged into gmail, but I'd be less apt to 'forget I was trying' to log in to that, and it would be less likely that random people would be users, so it would attract more suspicion. Still, This is something I'll watch out for.

Wilduck 16y ago
However, the article also mentioned that this could be used to immitate services other than gmail. I still buy the idea that people don't always look at the url when they switch back to a tab. Do you have the same practices with facebook and your bank account as you do with gmail?
- indrax 16y ago
  Facebook might get me, but I find it annoying. They would need to guess my bank first, and guessing wrong would set off alarm bells. (Moreso now than before I heard of this) Slightly related: I think new tabs should inherit history, so that I can clearly see how I got somewhere. If I don't remember having a tab with my bank login in it, and I see that I got there from reddit, I know things are very wrong. As it is, Most things I find on reddit open in tabs with no history, so they'd look exactly like I opened the directly.
- nhebb 16y ago
  I go one beyond with banking, PayPal, and other financial sites. I login with a single tab open. I log out when I'm done, and then I close the browser. Still, it's a pretty clever phishing attack, and I bet it would fool a lot of people. What I didn't get from the article was whether this was something Aza Raskin has seen, or a is it something that he thought up. If the later, then I'm not too sure about the scruples of publishing this trick while promoting the password manager in FF.

by indrax 16y ago

Wilduck 16y ago

However, the article also mentioned that this could be used to immitate services other than gmail. I still buy the idea that people don't always look at the url when they switch back to a tab. Do you have the same practices with facebook and your bank account as you do with gmail?

indrax 16y ago
Facebook might get me, but I find it annoying. They would need to guess my bank first, and guessing wrong would set off alarm bells. (Moreso now than before I heard of this) Slightly related: I think new tabs should inherit history, so that I can clearly see how I got somewhere. If I don't remember having a tab with my bank login in it, and I see that I got there from reddit, I know things are very wrong. As it is, Most things I find on reddit open in tabs with no history, so they'd look exactly like I opened the directly.
nhebb 16y ago
I go one beyond with banking, PayPal, and other financial sites. I login with a single tab open. I log out when I'm done, and then I close the browser. Still, it's a pretty clever phishing attack, and I bet it would fool a lot of people. What I didn't get from the article was whether this was something Aza Raskin has seen, or a is it something that he thought up. If the later, then I'm not too sure about the scruples of publishing this trick while promoting the password manager in FF.