4 ms·

CEO here, I also almost got taken by a fake legal notice about a Facebook post. My password manager would not auto enter my password so I tried manually enterin

CEO here, I also almost got taken by a fake legal notice about a Facebook post. My password manager would not auto enter my password so I tried manually entering it like a dummy. Fortunately, it was the wrong one.

latchkey 1y ago
This is exactly why I turned off auto enter.
- akerl_ 1y ago
  Isn’t turning off auto enter exacerbating the problem? The avenue for catching this is that the password manager’s autofill won’t work on the phishing site, and the user could notice that and catch that it’s a malicious domain
  - latchkey 1y ago
    Autofill doesn't always work for every site. So, now you're having to store in your mind where it works and where it doesn't. By disabling it, it forces you to go the extra step (command-shift-L) every time.
    - akerl_ 1y ago
      Autofill and the hotkey use the same mechanism, and neither is going to work on a phishing site.
      - latchkey 1y ago
        You're right. The point is that hotkey makes me think and observe more. Again, I don't have to remember if the site previous worked with autofill, or not.
        akerl_ 1y ago
        Sure. Except this is a story about the user manually copying the credential into a phishing site after the password manager didn’t fill it in. Whether that’s via a hotkey or not seems totally irrelevant.
        latchkey 1y ago
        It doesn't seem irrelevant to me at all. Security these days isn't just one action, it is a multitude of actions and steps and thought processes. By removing the expectation that my password manager is going to autofill something, I'm now making the conscious decision to always try to fill it myself. This makes me think more about what I'm doing, and prevents me from making nearly as many mistakes. I don't let my guard down to let the tools do all the work for me. I have to think: ok, I'll autofill things now, realize that it isn't working, and then look more closely at why it wasn't working as I expected. I won't just blindly copy/paste my credentials into the site because whoops, I think it might have worked previously.
  - tptacek 1y ago
    Yes. This is the problem with the "just use a password manager" answer to phishing-resistance. They can be a line of defense, situationally, but you have to have them configured just right, and if you're using phishing-resistant authentication you don't need that line of defense in the first place.
    - rtpg 1y ago
      Isn't this backwards? If the autocomplete doesn't show up that's a flag that the password is going somewhere it doesn't belong. If you're always copy-pasting from a password manager then you're not getting that check "for free". Obviously SSO-y stuff is _better_, but autofill seems important for helping to prevent this kind of scam. Doesn't prevent everything of course!
      - tptacek 1y ago
        None of this password manager configuration stuff matters; we've just got Passkeys set up for the account now, which is what we should have done, but didn't, because we spent the last 2 years with one foot out the door on Twitter altogether. Since this attack happened despite Kurt using 1Password, I'm really not all that receptive to the idea that 1Password is a good answer to this problem.
        rtpg 1y ago
        I guess I'm just saying "1Password with autofill" will help more than "1Password without autofill". We can always make mistakes of course. And yeah, sometimes we just haven't done something.
        tptacek 1y ago
        I'm saying: an intervention was required here, and that intervention was not changing how we use auto-fill. Doing that would be playing to lose.
        1y ago
- OkayPhysicist 1y ago
  No, that's the opposite of the moral of that story. If the person you responded to had listened to the fact that the auto-enter didn't auto-enter, they wouldn't have been at any risk. Likewise in the article, the problem was that the CEO copy-pasted the password into the phishing page's password field, NOT that the auto-enter prompted him to do so.
  - latchkey 1y ago
    As I mention below: Autofill doesn't always work for every site. So, now you're having to store in your mind where it works and where it doesn't. By disabling it, it forces you to go the extra step (command-shift-L) every time.
    - throw-10-8 1y ago
      Hide Sidebar? Honestly it sounds like you are missing the point while simultaneously using a bad password manager.
      - latchkey 1y ago
        That isn't hide sidebar and I use a common PM.
        throw-10-8 1y ago
        [dead]

latchkey 1y ago

This is exactly why I turned off auto enter.

akerl_ 1y ago
Isn’t turning off auto enter exacerbating the problem? The avenue for catching this is that the password manager’s autofill won’t work on the phishing site, and the user could notice that and catch that it’s a malicious domain
- latchkey 1y ago
  Autofill doesn't always work for every site. So, now you're having to store in your mind where it works and where it doesn't. By disabling it, it forces you to go the extra step (command-shift-L) every time.
  - akerl_ 1y ago
    Autofill and the hotkey use the same mechanism, and neither is going to work on a phishing site.
    - latchkey 1y ago
      You're right. The point is that hotkey makes me think and observe more. Again, I don't have to remember if the site previous worked with autofill, or not.
      - akerl_ 1y ago
        Sure. Except this is a story about the user manually copying the credential into a phishing site after the password manager didn’t fill it in. Whether that’s via a hotkey or not seems totally irrelevant.
        latchkey 1y ago
        It doesn't seem irrelevant to me at all. Security these days isn't just one action, it is a multitude of actions and steps and thought processes. By removing the expectation that my password manager is going to autofill something, I'm now making the conscious decision to always try to fill it myself. This makes me think more about what I'm doing, and prevents me from making nearly as many mistakes. I don't let my guard down to let the tools do all the work for me. I have to think: ok, I'll autofill things now, realize that it isn't working, and then look more closely at why it wasn't working as I expected. I won't just blindly copy/paste my credentials into the site because whoops, I think it might have worked previously.
- tptacek 1y ago
  Yes. This is the problem with the "just use a password manager" answer to phishing-resistance. They can be a line of defense, situationally, but you have to have them configured just right, and if you're using phishing-resistant authentication you don't need that line of defense in the first place.
  - rtpg 1y ago
    Isn't this backwards? If the autocomplete doesn't show up that's a flag that the password is going somewhere it doesn't belong. If you're always copy-pasting from a password manager then you're not getting that check "for free". Obviously SSO-y stuff is _better_, but autofill seems important for helping to prevent this kind of scam. Doesn't prevent everything of course!
    - tptacek 1y ago
      None of this password manager configuration stuff matters; we've just got Passkeys set up for the account now, which is what we should have done, but didn't, because we spent the last 2 years with one foot out the door on Twitter altogether. Since this attack happened despite Kurt using 1Password, I'm really not all that receptive to the idea that 1Password is a good answer to this problem.
      - rtpg 1y ago
        I guess I'm just saying "1Password with autofill" will help more than "1Password without autofill". We can always make mistakes of course. And yeah, sometimes we just haven't done something.
        tptacek 1y ago
        I'm saying: an intervention was required here, and that intervention was not changing how we use auto-fill. Doing that would be playing to lose.
        1y ago
OkayPhysicist 1y ago
No, that's the opposite of the moral of that story. If the person you responded to had listened to the fact that the auto-enter didn't auto-enter, they wouldn't have been at any risk. Likewise in the article, the problem was that the CEO copy-pasted the password into the phishing page's password field, NOT that the auto-enter prompted him to do so.
- latchkey 1y ago
  As I mention below: Autofill doesn't always work for every site. So, now you're having to store in your mind where it works and where it doesn't. By disabling it, it forces you to go the extra step (command-shift-L) every time.
  - throw-10-8 1y ago
    Hide Sidebar? Honestly it sounds like you are missing the point while simultaneously using a bad password manager.
    - latchkey 1y ago
      That isn't hide sidebar and I use a common PM.
      - throw-10-8 1y ago
        [dead]