4 ms·
They closest thing to avoiding being phished by a different "secure" entity is that your password manager will refuse to autofill (*) your credentials. But it's
by Arnavion 5y ago
They closest thing to avoiding being phished by a different "secure" entity is that your password manager will refuse to autofill (*) your credentials. But it's true that this is far from sufficient - this kind of autofill is wonky and doesn't work with all pages, so users can get conditioned to working around it by manually copying and pasting from the password manager to the browser, which defeats the protection. Many users prefer to always copy-and-paste anyway, because that avoids having to install the password manager's corresponding browser addon which can seem more secure.
(*): Note that "autofill" only means "automatically populate credentials", not "automatically populate credentials without any user interaction". Clicking the username field, choosing a credential from a dropdown that the password manager populated for you based on which credentials match the website in question, and then having it be applied is also "autofill".
- ChikkaChiChi 5y agoYou're right, that's woefully insufficient. The authentication challenge should clearly (using color and text) whether or not the challenge is an established part of your trust network and the hardware token should be able to validate the authenticity of the challenge modal itself. Users should be able to take an action they trust, while at the same time having the choice of that action taken away (or made more cumbersome) if they are about to get themselves into trouble. There are people far smarter than me working on these problems, but I feel like they are so hyperfocused on state-security that they refuse to listen to anyone regarding actual usability.