4 ms·

A password manager helps simply because it "remembers" exactly what sites you've been to in the past and if you go to a different site with a same looking url i

A password manager helps simply because it "remembers" exactly what sites you've been to in the past and if you go to a different site with a same looking url it won't auto-fill. Well, your browser also has a history of all the sites you've been to in the past, and people tend not to go to a lot of random sites. It would be pretty simple to display something when you go to a site you've never been to before. Just an unobtrusive, but not too unobtrusive, "this is your first visit to this site.". So when you see that on googie.com you might double check where you are. If the site url is similar to one you've been to in the past it could even say "Did you mean to go to one of these sites with similar looking names?...." I'm not sure what the deal is with shilling for a vpn, or how that helps. It doesn't.

Wowfunhappy 6y ago
> Well, your browser also has a history of all the sites you've been to in the past, and people tend not to go to a lot of random sites. It would be pretty simple to display something when you go to a site you've never been to before. Just an unobtrusive, but not too unobtrusive, "this is your first visit to this site.". Whoa, that seems like a shockingly good idea! It could look similar to what happens when you enter data into a password field on a non-https website. The browser can pop up a little box under the input when you start typing, which says something like "this is your first time visiting this website. Only enter passwords on websites you trust." Are there any major downsides I'm missing? Signing up for accounts on new sites would certainly create false-positives, but if the warning is properly coded that doesn't seem like such a problem.
- cmeacham98 6y ago
  Several people are suggesting this on this post, but it won't work for input. The phishers will just stop using password forms. And if you make it for all forms, well that can probably be faked trivially with javascript. It _would_ work for first time visits, but I propose that it will be too common that people will ignore it or brainlessly click through it, providing little to no security benefit. Phishing is an artifact of the bad design of the system of remembering a password, and will likely continue until we design and widely deploy a better alternative.
  - lann 6y ago
    You could trigger on any keypress on a first-time site.
    - hansvm 6y ago
      Hopefully being careful with TAB or anything else somebody might be using for navigation. God help you if you use vimium in that world.
- nneonneo 6y ago
  Hell, that warning could be helpful even on signups to new sites: “This is your first time visiting this website. Only enter passwords on websites you trust, and don’t reuse passwords from other sites. We recommend you use this securely-generated password:”
  - Wowfunhappy 6y ago
    Idk, I’d get a little nervous extending it too much. Browsers and sites have far too many use-our-new-feature-plz popups. This shouldn’t look like that, or it’s more likely to be ignored. I might keep your first addition but nix the final paragraph, as good a suggestion as it may be.
    - nneonneo 6y ago
      To be fair, my browser (Firefox) already suggests a secure random password on password dialogs for sign-ups; I believe they are either using the heuristic of "no password saved on the site" or "password confirmation box exists". I was more-or-less simply thinking of extending that particular message.
  - pvorb 6y ago
    Finally a way to know if you should try to reset your password before creating a new account. It sometimes happens that I don't remember I've already signed up for some site and forgot about it entirely.

Wowfunhappy 6y ago

> Well, your browser also has a history of all the sites you've been to in the past, and people tend not to go to a lot of random sites. It would be pretty simple to display something when you go to a site you've never been to before. Just an unobtrusive, but not too unobtrusive, "this is your first visit to this site.". Whoa, that seems like a shockingly good idea! It could look similar to what happens when you enter data into a password field on a non-https website. The browser can pop up a little box under the input when you start typing, which says something like "this is your first time visiting this website. Only enter passwords on websites you trust." Are there any major downsides I'm missing? Signing up for accounts on new sites would certainly create false-positives, but if the warning is properly coded that doesn't seem like such a problem.

cmeacham98 6y ago
Several people are suggesting this on this post, but it won't work for input. The phishers will just stop using password forms. And if you make it for all forms, well that can probably be faked trivially with javascript. It _would_ work for first time visits, but I propose that it will be too common that people will ignore it or brainlessly click through it, providing little to no security benefit. Phishing is an artifact of the bad design of the system of remembering a password, and will likely continue until we design and widely deploy a better alternative.
- lann 6y ago
  You could trigger on any keypress on a first-time site.
  - hansvm 6y ago
    Hopefully being careful with TAB or anything else somebody might be using for navigation. God help you if you use vimium in that world.
nneonneo 6y ago
Hell, that warning could be helpful even on signups to new sites: “This is your first time visiting this website. Only enter passwords on websites you trust, and don’t reuse passwords from other sites. We recommend you use this securely-generated password:”
- Wowfunhappy 6y ago
  Idk, I’d get a little nervous extending it too much. Browsers and sites have far too many use-our-new-feature-plz popups. This shouldn’t look like that, or it’s more likely to be ignored. I might keep your first addition but nix the final paragraph, as good a suggestion as it may be.
  - nneonneo 6y ago
    To be fair, my browser (Firefox) already suggests a secure random password on password dialogs for sign-ups; I believe they are either using the heuristic of "no password saved on the site" or "password confirmation box exists". I was more-or-less simply thinking of extending that particular message.
- pvorb 6y ago
  Finally a way to know if you should try to reset your password before creating a new account. It sometimes happens that I don't remember I've already signed up for some site and forgot about it entirely.