4 ms·

This makes no sense any way I look at it. "youtube.com" could show you a fake keyboard anyways and why can't it trick you with a real keyboard.

ben_w 6y ago
Two situations, how do you distinguish them?: 1. The username/password form of your bank, as shown in your browser. 2. A pixel-perfect fake of your bank as it would look if you were to go there directly in your browser, including the browser UI, except you’re actually looking at a full-screen image displayed on a random scammer website, and you already were in the fake when you typed the bank domain name into the fake address bar on the fake UI.
- dcow 6y ago
  How about a site that says it will help you log into your bank and secure your bank credentials?
  - ben_w 6y ago
    Because your hypothetical is something a user can learn to avoid, whereas my hypothetical is one where literally no user could distinguish real from fake without assistance from the OS or the browser.
    - dcow 6y ago
      What about Plaid? Should users avoid that?
      - guipsp 6y ago
        ...Yes? The point is that you should be aware of who you're giving your information to.
        dcow 6y ago
        Plaid is a valid service that helps glue bank APIs together. Why should it be avoided? I am not arguing your point strictly. But the problem in general can only really be solved with education. Users should always know who they’re giving credentials to. A technical measure like not allowing keyboard input in a full screen browser is a leaky stop gap. The full screen app could just as well show its own pixel perfect full screen keyboard and trick users to tap it.
        ben_w 6y ago
        > The full screen app could just as well show its own pixel perfect full screen keyboard and trick users to tap it. You should’ve led with that, it’s a much better question than your others on this thread.
      - gruez 6y ago
        If you care about security, yes. It operates identically to a phishing service, complete with a logos/imagery to suggest you're sending your credentials to your bank rather than a third party. What's worse is that as far as the user's concerned, they're inputting their credentials into the consumer site[1], as you can see in the demo: https://plaid.com/demo https://plaid.com/demo. This is as opposed to something like google oauth where you enter your credentials on accounts.google.com only. [1] ie. you're on site A, which wants access to your account details on bank X. when you're entering your details, the address bar shows site A's domain, not plaid.com or bank X.
        dcow 6y ago
        I guess I would say it the other way around: phishing services operate identically to legit services. If we outlaw everything that someone has attempted to phish we’ll eventually have nothing. If a user trusts plaid to handle their credentials, so be it.
dcow 6y ago
Exactly, it could just show a real keyboard, tell you it’s got a new discount partnership with Pornhub premium and catch you trying to log in.
tedunangst 6y ago
And it will say youtube.com at the top of the screen, which my real bank app does not.

ben_w 6y ago

Two situations, how do you distinguish them?: 1. The username/password form of your bank, as shown in your browser. 2. A pixel-perfect fake of your bank as it would look if you were to go there directly in your browser, including the browser UI, except you’re actually looking at a full-screen image displayed on a random scammer website, and you already were in the fake when you typed the bank domain name into the fake address bar on the fake UI.

dcow 6y ago
How about a site that says it will help you log into your bank and secure your bank credentials?
- ben_w 6y ago
  Because your hypothetical is something a user can learn to avoid, whereas my hypothetical is one where literally no user could distinguish real from fake without assistance from the OS or the browser.
  - dcow 6y ago
    What about Plaid? Should users avoid that?
    - guipsp 6y ago
      ...Yes? The point is that you should be aware of who you're giving your information to.
      - dcow 6y ago
        Plaid is a valid service that helps glue bank APIs together. Why should it be avoided? I am not arguing your point strictly. But the problem in general can only really be solved with education. Users should always know who they’re giving credentials to. A technical measure like not allowing keyboard input in a full screen browser is a leaky stop gap. The full screen app could just as well show its own pixel perfect full screen keyboard and trick users to tap it.
        ben_w 6y ago
        > The full screen app could just as well show its own pixel perfect full screen keyboard and trick users to tap it. You should’ve led with that, it’s a much better question than your others on this thread.
    - gruez 6y ago
      If you care about security, yes. It operates identically to a phishing service, complete with a logos/imagery to suggest you're sending your credentials to your bank rather than a third party. What's worse is that as far as the user's concerned, they're inputting their credentials into the consumer site[1], as you can see in the demo: https://plaid.com/demo https://plaid.com/demo. This is as opposed to something like google oauth where you enter your credentials on accounts.google.com only. [1] ie. you're on site A, which wants access to your account details on bank X. when you're entering your details, the address bar shows site A's domain, not plaid.com or bank X.
      - dcow 6y ago
        I guess I would say it the other way around: phishing services operate identically to legit services. If we outlaw everything that someone has attempted to phish we’ll eventually have nothing. If a user trusts plaid to handle their credentials, so be it.

dcow 6y ago

Exactly, it could just show a real keyboard, tell you it’s got a new discount partnership with Pornhub premium and catch you trying to log in.

tedunangst 6y ago

And it will say youtube.com at the top of the screen, which my real bank app does not.