5 ms·
I get an email claiming that I have unread Linkedin messages. The email uses their Logos. But if I were to click any of the links in the email, it would send me
by herodotus 8y ago
I get an email claiming that I have unread Linkedin messages. The email uses their Logos. But if I were to click any of the links in the email, it would send me to a php or html file that contains a Javascript redirect script. That script, if executed, then goes to the phishers actual page. Sometimes, there is an additional DNS redirect at the JS redirected page. For some reason, the JS redirect tries to hide the redirect by encoding the target URL in an array of integers. The script converts the numbers to characters, concatenates them, and then sets the location property of the DOM. If there was enough interest, I could write all this stuff up as a blog.
- EGreg 8y agoThe solution should be to just stop using human generated passwords and instead have each site generate their own and for browsers and apps use password managers built into the OS and offer to fill them in based on the domain. This is increasingly happening. We need the large sites to move to this to eliminate phishing entirely. So https://f00l.com https://f00l.com isn’t same as https://fool.com https://fool.com
- mtone 8y agoI use Keepass and still manually paste and autosave my passwords. Have browsers extensions improved for this? When I last checked 5 and 10 years ago, it didn't seem to work.
- sokoloff 8y agoFor sites that I don't care that much about, I use and like Chrome's (relatively) new password manager [0]. I haven't looked into it in enough depth to be 100% convinced to trust it with my financially-linked passwords. (In reality, it's almost surely good enough, but I haven't reached that informed conclusion yet.) [0] - https://www.blog.google/products/chrome/chrome-password-manager/ https://www.blog.google/products/chrome/chrome-password-mana...
- L_Rahman 8y agoOh yes. 1Password X for Firefox and Chrome, 1Password on Safari have pretty much solved this problem. The vast majority of passwords I fill are CMD + [shortcut]. Generating and saving new ones works like that maybe 50% of the time. The failure rate however is driven less by the extension technology and more by the password form itself.
- Jaruzel 8y agoAll you've done there is move the attack target from the website to the users device. The obvious solution is to remove all users from the internet.
- EGreg 8y agoIs this a joke?
- Boulth 8y agoYes, that's exactly how U2F works (it's scoped to domain/origin). FIDO2 builds on top of that.
- mblast311 8y agoI would be interested!