3 ms·
I've been saying this the whole time and nobody seems to view it as a serious problem. Sure, there are users who will use the same username and password on ever
by kogir 17y ago
I've been saying this the whole time and nobody seems to view it as a serious problem. Sure, there are users who will use the same username and password on every site, and there's no hope for them. However, there is a class of users who might think with openid they can use the same credentials for their bank as they do for facebook, but not know to check for valid ssl certificates and nefarious proxying.
Can someone who doesn't believe the phishing potential is real please tell me why? What am I missing?
- kniwor 17y agoGood openid providers like wordpress train their users not to expect a login page on anything a authenticating website redirects them to.
- whopa 17y agoAnd as I said in my original comment, you can't rely on user education. If we've learned anything about the psychology of phishing, it's that.