5 ms·
Good reminder that you should never be in the mindset of "expecting" a phish from any source - trust is how they get you. Also, if a message was really urgent,
by ivanbakel 9y ago
Good reminder that you should never be in the mindset of "expecting" a phish from any source - trust is how they get you. Also, if a message was really urgent, you wouldn't have to click-through to see it.
- gruez 9y ago>Also, if a message was really urgent, you wouldn't have to click-through to see it. i don't get that logic. what's the difference between Your adwords account was suspended due to suspected click fraud. [bunch of made up plausible reasons]. you may appeal by going to your adwords control panel [phising link here] and Your adwords account was suspended. click here to see why [phising link here]. in both cases you'd be pretty tempted to click the link.
- sillysaurus3 9y agoI think I'm misreading your comment, but the best defense against phishing is to always be expecting a phishing attack from every source. Every time you're about to paste your password, glance at the url bar.
- function_seven 9y agoI read it as, “you should never be in the mindset of ‘expecting’ a phish from any [specific] source.” I think OP agrees with you.
- pfg 9y agoPassword managers with browser extensions are a good fix for this too. If you're used to entering your password only through the extension, not being able to do that on a login screen would be a big warning sign. Admittedly, these extensions have had some vulnerabilities in the past, but phishing is simply a bigger problem for the vast majority of users. Obviously, for sites that support U2F (like Google), getting a YubiKey or any other U2F-compatible key would be the best protection against this.
- tfigment 9y agoSemi-relevant link from Bruce Schneier on the subject and that he did not design password safe with a browser extension in mind. https://www.schneier.com/blog/archives/2014/09/security_of_pas.html https://www.schneier.com/blog/archives/2014/09/security_of_p.... The android version implements a keyboard replacement rather than integrate though not as easy to use is still mostly usable.
- taneq 9y agoI think you're both right - they way I read their comment was more like "if you expect a phishing attack from certain sources, this implies you're not on the defensive against attacks which aren't from those sources".
- laurencei 9y ago> Every time you're about to paste your password, glance at the url bar. Actually - I disagree with this. You can no longer "glance" at the url bar to determine if you are on the right domain due to Unicode chars if you clicked a link. The only safe way is to type the url yourself into the browser. If it is a long link - then at least typing the base domain, and pasting the "rest" is probably safe?
- mikeash 9y agoI use 1Password to autofill my passwords, which it won't do if the domain doesn't match, which should also work.
- sillysaurus3 9y agoThis actually isn't true. A website like https://www.xn--80ak6aa92e.com/ https://www.xn--80ak6aa92e.com/ won't show up as apple.com. Browsers don't allow Unicode rendering in the URL bar. Maybe IE is affected though. I haven't tested every browser. But it's a known security concern.