3 ms·
Do regular people verify domains? It feels like the entire domain based trust model has been eroded by in-app browsers eliding the chrome for “simplicity” and e
by klabb3 2y ago
Do regular people verify domains? It feels like the entire domain based trust model has been eroded by in-app browsers eliding the chrome for “simplicity” and even bank/visa official payment gateways that are redirecting you all over weird partner domains and microservice endpoints. Plus of course lack of education and mantras that mortals can follow at all times.
If users don’t verify domains, isn’t good old phishing more effective, like the $5 hammer in that xkcd?
- n2d4 2y agoRegular people may not but password managers do. Maybe not everyone, but at least security-conscious people would grow suspicious when their password manager doesn't autofill credentials on a page, and wouldn't immediately jump to manually entering it. (SSO also reduces the attack surface of phishing, though of course then the attacker just has to phish the identity provider's credentials instead.)