3 ms·
>what's stopping someone from making a version of the same scheme that redirects to a prompt on the real site which authorizes them as a new user I can give a
by nailer 2y ago
>what's stopping someone from making a version of the same scheme that redirects to a prompt on the real site which authorizes them as a new user
I can give a better answer than the sibling:
The passkey is domain bound, so the UI won't show up on the phishing site before the passthrough can even happen.
Password managers are also domain-bound though.
- Terretta 2y ago> Password managers are also domain-bound though. are also --> can be Often they allow picking an entry for arbitrary domain names, made necessary by firms (such as Microsoft) randomizing their login domains to look like phishing domains.* * Not what they are doing, but to the casual user, logging into xbox.com, office.com, or even microsoft.com through something like microsoftonline.com may as well be phishing.
- nailer 2y agoAgreed. Even a few hours ago I got something for w-m.com (!) which was actually genuinely sent by Walmart.
- Cpoll 2y agoI wouldn't assume a 3-character .com is a phishing domain, they're hardly cheap and disposable. But I get your point, I've seen some suspicious (legitimate) alternate domains. Stuff like (not a real example) amazon-fulfillment.com.
- nailer 2y agoA dash in a domain though is pretty ratchet.