6 ms·
You typo an address in your URL bar and an attacker can serve you a fake login page of your intended destination complete with valid SSL cert.
by eli 7y ago
You typo an address in your URL bar and an attacker can serve you a fake login page of your intended destination complete with valid SSL cert.
- taqcp 7y agoRegular users should not be using the URL bar, they should type whatever they want in the search bar.
- saagarjha 7y agoAnd click on the first link, which is a Google ad?
- Endy 7y agoI disagree strongly here. We should be encouraging users to take responsibility and agency for their actions. As admins and tech-aware people in our circles, we should be constantly encouraging better habits like typing URIs manually, decreasing the use of search engines for non-search purposes, and trying to spread literacy. Besides, it's not like we should ever trust a search engine as an authority on anything but the results that bring the host company more money.
- joshuamorton 7y agoWhy is typing a URI manually better? It's undoubtedly less secure and it's upside is...what exactly?
- Endy 7y agoPersonal responsibility is the main benefit; teaching people to look twice at what they do on the Internet. And frankly speaking, if manual user entry is less secure than software that the user does not own from metal to UI, then we need to upgrade the users, not the Web. Demanding a manual entry means that the user is taking deliberate action, not following whatever some piece of software is telling them to be correct.
- joshuamorton 7y agoPersonal responsibility, in and of itself, is not usually considered to be a benefit. It is considered a thing one has to undertake to achieve a benefit. You seem to be suggesting that if I intend to visit mywebsite.com, that typing "myw", seeing "mywebsite.com", and hitting enter is somehow less deliberate than typing "mywebsit.com" and going to a site that was not my intent. Given that only the first one of these things reflects my intent, describing the second as deliberate and the first as not-deliberate requires some odd twisting of definitions. Your fear, it seems to be, is that tools we use might influence how we act. This is nothing new. Stories started to rhyme less when we figured out how to write things instead of memorizing them. That was still probably undoubtedly an improvement. So can you perhaps clarify what specific influences that our tools have might be bad? For example, my browser suggesting "mywatertower.com" instead of "mywebsite.com" because the first paid for a higher position. That seems a reasonable end state to fear, but I have no reason to believe we're heading that direction. Do you? Is inconveniencing (literally) billions of people and forcing them to take less secure paths to do what they want worth avoiding a possibility that certainly doesn't seem imminent?
- Endy 7y agoTo me, it's definitely worth it to "inconvenience" people and demand conscious behavior. With the largest browser vendor being the largest advertising agency and the largest search engine, encouraging anyone to have anything beyond the barest minimum to do with them goes against everything I believe in. Search engines should not be able to intercede in direct Web activity; they should be used for content discovery and nothing else. You should not be able to type three letters and get a full URL unless you personally wrote a macro to do that. Then again, when users stopped having to specify protocol for every server, that was probably the beginning of the end of deliberate browsing. My fear is really that people take the Web and the Internet as a whole for granted; and I want to see procedures put in place to demand that all users be aware of their actions, what data they share with servers, and all of what's being downloaded to their computer. I don't like having to remind people that there is no "Cloud", only someone else's computer. And you're saying you trust that other person's machine and security more than your own by storing critical data there. Or pointing out what having one CDN for so much of the Web did last month.
- azinman2 7y agoManually typed URIs lack spell check. Google has this built in. The probability of Google not taking you to Chase but some malicious site is far far lower than a typo of a manual url being registered.
- paol 7y agoThat's already the case whatever local network you happen to be using.
- dmortin 7y agoI connect all my usual sites with history completion from the address bar. I never type them.
- EGreg 7y agoI don’t know if you are right, it depends on whether your word “typo” is a typo - itself a very meta thing! “You typo an address” — well, then, sure. But how did you manage to typo an address that’s exactly where the attacker put their stuff, and the bank didn’t catch them? Now, if you meant “type”, then NO. Unless the browser includes a certificate authority that gave out a certificate to the attacker for that domain, the browser will flag this “valid” SSL cert.
- _-___________-_ 7y agoNo, attacker can just MITM your DNS traffic and synthesise lots of typosquats of their own. They can't do the actual bigbank.com or facebook.com domains thanks to various protections like HSTS, but typos are unlikely to have HSTS preload etc, and they can have vast numbers of them at basically zero cost.
- mr_puzzled 7y agoSolved by using something like cloudflare's 1.1.1.1?
- _-___________-_ 7y agoNot at all, since the DNS traffic to 1.1.1.1 is still unencrypted and unauthenticated (unless you're using DNSCrypt or similar, or the domain you're looking up uses DNSSEC and you're using a validating resolver).
- mr_puzzled 7y agoCorrect me if I'm wrong, but I think the ios app has dns over https or dns over tls enabled.
- _-___________-_ 7y agoNo idea; I took your comment to refer to using 1.1.1.1 for DNS in general, since it didn't mention any app.
- merpnderp 7y agoBut will my credential autofill put in my creds? I think people are still safe.