3 ms·
Another issue regarding security, is the fact that a phishing website will look a lot more convincing if you're by default only exposed to its page title.
by MasterScrat 16y ago
Another issue regarding security, is the fact that a phishing website will look a lot more convincing if you're by default only exposed to its page title.
- Bossman 16y agoYou bring up a great point. For this reason, I really hope Google makes improvements for his. It would be great to have a notification area on or right near the tab that alerts you to possible phishing attempts.
- etcet 16y agoDo you really think that Google are going to hide their https signals? If anything, hiding the URL gives phishers less to use. So marlinspike demonstrated that you can 'spoof' "https:// https:// and fake a secure looking favicon. But can you spoof the browser detecting a secure connection and then turning the page tab bright green? I don't know how they are going to do it but I bet their positive feedback signals are going to be strong and very hard to spoof.
- burgerbrain 16y ago"But can you spoof the browser detecting a secure connection and then turning the page tab bright green?" The important part of what Marlinspike showed is that you don't have to. He ran his setup on a Tor exit node, the users of which are presumably more security minded than the rest of the general population, and not a single user balked at the lack of positive feedback. HSTS is a real solution, but not a scalable one.