3 ms·

I'm an engineer (mostly web) and I am very tech savvy, and extremely wary on the internet of scams. However, if this site had to come me via a trusted channel,

I'm an engineer (mostly web) and I am very tech savvy, and extremely wary on the internet of scams. However, if this site had to come me via a trusted channel, I would have fallen for it maybe 80% of the time. I hardly ever login to steam as it's always running and while I have 2FA my password would have been stolen in this attack for sure. I don't think teenagers and non-techy users would stand a chance against this.

code_duck 8y ago
Non-techy users don’t really stand a chance against anything, especially when you consider the attackers only need to get .1% for meaningful results.
- tialaramex 8y ago
  Brick wall UX. That's the recurring lesson in security design. WebAuthn does this. The user may really, really want to give fakebank.example their credentials for the real bank but they can't. Dancing pigs, free money, urgent message from God, it doesn't matter why the user feels compelled to give away their credentials if they can't.
hycaria 8y ago
When it's too good to be true, it just isn't. Here, you can avoid all those scams !
kylebarron 8y ago
Note that LastPass didn't autofill the password and the box stayed gray instead of red. That would tip off most LastPass users that the url was wrong. edit: Image in question: https://i.imgur.com/hVTEKfD.png https://i.imgur.com/hVTEKfD.png
- wild_preference 8y ago
  1Password saved me from getting phished by “colnbase.com” because the completion hotkey didn’t work. I still wince thinking about how close I got. You used to just have to be moderately tech savvy to avoid scams but I find myself tricked more and more often these days. Recently it was a “click to start download” ad. I sent the page to my friends and they got fooled too.
- Buge 8y ago
  That image appears to be using the new Chrome UI in the top level, and the old Chrome UI in the fake window.

code_duck 8y ago

Non-techy users don’t really stand a chance against anything, especially when you consider the attackers only need to get .1% for meaningful results.

tialaramex 8y ago
Brick wall UX. That's the recurring lesson in security design. WebAuthn does this. The user may really, really want to give fakebank.example their credentials for the real bank but they can't. Dancing pigs, free money, urgent message from God, it doesn't matter why the user feels compelled to give away their credentials if they can't.

hycaria 8y ago

When it's too good to be true, it just isn't. Here, you can avoid all those scams !

kylebarron 8y ago

Note that LastPass didn't autofill the password and the box stayed gray instead of red. That would tip off most LastPass users that the url was wrong. edit: Image in question: https://i.imgur.com/hVTEKfD.png https://i.imgur.com/hVTEKfD.png

wild_preference 8y ago
1Password saved me from getting phished by “colnbase.com” because the completion hotkey didn’t work. I still wince thinking about how close I got. You used to just have to be moderately tech savvy to avoid scams but I find myself tricked more and more often these days. Recently it was a “click to start download” ad. I sent the page to my friends and they got fooled too.
Buge 8y ago
That image appears to be using the new Chrome UI in the top level, and the old Chrome UI in the fake window.