3 ms·
> Some third party detects you're trying to sign into a website. And this third party can find out how, exactly?
by rambambram 4y ago
> Some third party detects you're trying to sign into a website.
And this third party can find out how, exactly?
- ben_w 4y agoOff the top of my head, even in HTTPS the domain name isn't encrypted, which may be enough to make a good guess. Or possibly just guessing without evidence because the sending cost of junk email is so low — looking at my junk mail folders, I have reason to believe they guess. FWIW, I've heard of this type of attack (deliberately timed) being used during house purchases, with a fake destination bank message preceding the real message by a few minutes. Does anyone know if that's real or just an urban legend?
- rambambram 4y agoAh, like that you mean. Thanks. I was thinking of embedded third party code on a website (which might better not be included on sensitive pages).