3 ms·
ive thought of a mitigation for this - always intentionally enter the wrong password on the first try. if you're being phished, you'll notice when the wrong pas
by swyx 4y ago
ive thought of a mitigation for this - always intentionally enter the wrong password on the first try. if you're being phished, you'll notice when the wrong password gets you in
- function_seven 4y agoI thought some phishing attacks act as a relay or middle-man? I don't know how common that is.
- coder543 4y ago100% correct. You might have 2 factor enabled, so they also need to check that and phish the 2FA code as well. That 2FA code expires quickly, so it needs to be used in real time to get a session. I'm sure there are some very basic phishing attacks that just save whatever you entered, but... let's avoid trying to come up with "clever hacks" that only lend a false sense of security.
- eviks 4y agoa much more convenient mitigation - create an item without a password, so it would autofill username (and not autofill if you're being phished, so domains wouldn't match), so all you'd have to do is enter the password from memory