4 ms·

This is why an auto-filling password manager is an essential security tool for every internet user. If your password manager doesn't autofill/offer to fill your

by ripdog 6y ago

This is why an auto-filling password manager is an essential security tool for every internet user. If your password manager doesn't autofill/offer to fill your passwords, the domain isn't legitimate. Password managers are great for security and super convenient. It continues to shock me how many people surf the web while continuing to type the same password into dozens of sites, and then they wonder why they fall for phishing.

novok 6y ago
Autofill matching breaks in many ways on the same website, so you have to keep on doing it manually. Ex: Chase has about 5 different ways / pages you can enter your login credentials.
- ripdog 6y ago
  That sounds awful, but all you need to do is add all the legitimate domains to your chase login record, then you are phish-proof. Obviously autofill itself can break on complex page layouts, and that's fine. The security comes from the password manager doing domain matching and offering to fill the password when you click on its addon menu.
- ProZsolt 6y ago
  That's the breading ground of phishing. If they have 5 login page a sixth won't raise any red flags.
- cerberusss 6y ago
  > Chase has about 5 different ways / pages you can enter your login credentials If they had 5 different ways, that'd be one thing. Lately, I've been seeing different domains. For example the marketing department registers a domain such as AcmeExclusives.com.
acdha 6y ago
No, this is why FIDO/U2F is essential. Password managers are good but people regularly search and autofill across domains because most companies, especially in industries like finance and HR, have spent years training users to expect random vanity domains and renaming every time someone in marketing wants to mark their territory. People phish TOTP similarly. In contrast, the FIDO design cannot be used across domains no matter how successfully you fool the human.
- ripdog 6y ago
  Sounds great, but U2F keys are super expensive and U2F is supported nowhere. Password managers are free and work everywhere already.
  - acdha 6y ago
    U2F keys start at $15, so there’s a barrier but it’s hardly “super expensive”, and they’re supported by a fair fraction of major sites (Facebook, Google, Twitter, GitHub, Gitlab, login.gov, etc.).

by ripdog 6y ago

novok 6y ago

Autofill matching breaks in many ways on the same website, so you have to keep on doing it manually. Ex: Chase has about 5 different ways / pages you can enter your login credentials.

ripdog 6y ago
That sounds awful, but all you need to do is add all the legitimate domains to your chase login record, then you are phish-proof. Obviously autofill itself can break on complex page layouts, and that's fine. The security comes from the password manager doing domain matching and offering to fill the password when you click on its addon menu.
ProZsolt 6y ago
That's the breading ground of phishing. If they have 5 login page a sixth won't raise any red flags.
cerberusss 6y ago
> Chase has about 5 different ways / pages you can enter your login credentials If they had 5 different ways, that'd be one thing. Lately, I've been seeing different domains. For example the marketing department registers a domain such as AcmeExclusives.com.

acdha 6y ago

No, this is why FIDO/U2F is essential. Password managers are good but people regularly search and autofill across domains because most companies, especially in industries like finance and HR, have spent years training users to expect random vanity domains and renaming every time someone in marketing wants to mark their territory. People phish TOTP similarly. In contrast, the FIDO design cannot be used across domains no matter how successfully you fool the human.

ripdog 6y ago
Sounds great, but U2F keys are super expensive and U2F is supported nowhere. Password managers are free and work everywhere already.
- acdha 6y ago
  U2F keys start at $15, so there’s a barrier but it’s hardly “super expensive”, and they’re supported by a fair fraction of major sites (Facebook, Google, Twitter, GitHub, Gitlab, login.gov, etc.).