3 ms·
A browser-based password manager mostly solves the confusables problem. If your password manager matches by domain name, and someone tries to phish you, it will
by jniedrauer 6y ago
A browser-based password manager mostly solves the confusables problem. If your password manager matches by domain name, and someone tries to phish you, it will immediately clue you in that something's not right.
Unfortunately this doesn't solve the problem in general, because most people don't use password managers.
- julianozen 6y agoAnd I frequently need to add alternative trusted URLs to 1Password so that auto fill works on the same authentication across different domains (this I find I need often for like banks)
- tatersolid 6y agoAirline sites are the worst in this regard. United, American, Delta, etc. bounce you around between multiple phishy-looking domains to redeem miles or use their benefits. And none of them use their own site as a proper OpenID connect or OAUTH IDP and require re-logging in with your airline username and password on different domains!
- danellis 6y agoSubmitting your password to a site isn't the only concern. Downloading executables, for example.
- michaelmrose 6y agoWhat if the attack is targeted at new users. Work on signing people up for Netflix then drain their bank account.