4 ms·
Ever since I almost got phished (wasn't looking closely enough at the domain to notice a little stress mark over the "s" in the domain name, thankfully I was us
by stavros 1y ago
Ever since I almost got phished (wasn't looking closely enough at the domain to notice a little stress mark over the "s" in the domain name, thankfully I was using a hardware wallet that prevented the attack entirely), I realized that anyone can get phished. They just rely on you being busy, or out, or tired, and just not checking closely enough.
Use passkeys for everything, like Thomas says.
- deleted 1y ago[deleted]
- ChrisMarshallNY 1y agoIf you grok Apple, I wrote up a tutorial on very basic PassKey implementation (for iOS apps), here: https://littlegreenviper.com/series/passkeys/ https://littlegreenviper.com/series/passkeys/
- stavros 1y agoVery nice, thanks! By the way, the preferred capitalization is "passkeys", like "passwords". It's not supposed to be capitalized like a proper noun.
- ChrisMarshallNY 1y agoI prefer all lowercase. Not sure where I got the CamelCase version, but it may have been from the Apple or FIDO docs. I’d like to write a follow-up that covers authentication apps/devices, but I need to do some research, and find free versions.
- Y_Y 1y agoCounterpoint: don't use passkeys, they're a confused mess and add limitations while not giving any benefits over a good long password in a password manager.
- bigyabai 1y agoYep. A technical half-baked solution to a problem that has been solved since it's inception. Really just feels like FAANG exists to invent new ways to charge rent...
- akerl_ 1y agoWhat’s the solution for preventing this kind of phishing attack?
- NoGravitas 1y agoTLS client certificates. Unfortunately, the browser UI for them ranges from godawful to removed-because-nobody-used-them.
- akerl_ 1y agoSo the solution for this isn’t actually usable?
- dewey 1y agoThey prevent you from being one of these, and copy pasting the password from password manager into the wrong input field. Something that still happens often with many websites not properly auto-filling from password managers. > They just rely on you being busy, or out, or tired, and just not checking closely enough
- kgeist 1y ago>I realized that anyone can get phished A few years ago, I managed to get our InfoSec head phished (as a test). No one is safe :)