4 ms·
Why not ask users to set a unique phrase to identify themselves when you set up the OS? If this phrase isn't in the box that asks for a master password, you kno
by iamben 9y ago
Why not ask users to set a unique phrase to identify themselves when you set up the OS? If this phrase isn't in the box that asks for a master password, you know it's phishing. Hell, just put that IN the copy on the master password box.
"If the words below do not match your unique phrase, do not enter your password."
If I see "Green eggs and ham", I know it's safe to put in my password.
- eli 9y agoIt's a good idea, but a security solution that relies on users noticing when something is absent is not exactly airtight.
- blowski 9y agoNo solution is airtight, but if it makes it better for 10% of users without making it worse for the other 90%, it seems like a good idea.
- zwily 9y agoMy guess is that a large % of unsavvy users would put their password in that field, making things much, much worse.
- jclardy 9y agoHuh? How? Those users would be entering in their passwords in the dialogs today. Adding a visual indication of a secure dialog can at least help the power users, while not changing anything for the ones that don't know the difference. EDIT: Oh sorry, I seen what you are saying now - entering password into the phrase field. Instead, just make it an image that the user selects, or even creates.
- UnoriginalGuy 9y agoIt will just be used for blame shifting. "You didn't notice one of the dozen popups asking for credentials lacked your magical hidden phase YOUR FAULT!" If Apple were going to explore a strategy to fix this, they would likely be better off redirecting the user out of the app before asking for credentials, or prompting them in notifications/home screen only.
- skykooler 9y agoThis is the approach my bank's login uses.
- thisisdave 9y agoEven better, add an indicator light to the hardware that shows the OS is asking and not an app (although this suffers from the same problem that users need to notice something is absent).
- earenndil 9y agoCouldn't an app screenshot the screen after asking you to authenticate, and thus capture the phrase?
- perlgeek 9y agoYahoo used that, except with an image, not a phrase. And then one day yahoo.com didn't show that image anymore. What do I do then, as a user? At this time, I didn't care much about my yahoo account, so I simply didn't log in anymore; but in general, this solution leaves the user alone. You need to give them a potential remedy when that happens.
- asdfaefasdf 9y agoWhat if my fake popup just doesn't include the warning message. The user just forgets that it's supposed to be there at all.