4 ms·
But how do I, as a website-user, know who I'm telling my credentials?
by jackewiehose 6y ago
But how do I, as a website-user, know who I'm telling my credentials?
- sp332 6y agoYou can check the address bar and TLS certificate.
- jackewiehose 6y agoI can do that as a professional. But even I don't trust popup-windows for google/facebook/mybank opened from another website. I prefer to educate people to only enter credentials when they opened the website manually by themselves. That is also easier than trying to teach someone who can't distinguish between the address bar and the google-search field, what a domain and TLS is.
- sp332 6y agoSo maybe an app could send a request to Apple, then require you to open a new window and log in to the Apple site, navigate to an apps request page, find the right request, allow it, then go back to the original app. Or maybe copy a really long string and paste it, then copy the response and paste it back into the app. But you can see why no one did it this way right?
- filleduchaos 6y agoI mean, it is rather obvious if one has taken the time to go through such a flow (or even to just look at screenshots of how it works).