home.social

#fake-websites — Public Fediverse posts

Live and recent posts from across the Fediverse tagged #fake-websites, aggregated by home.social.

fetched live
  1. @chazh : no, my proposal is unrelated to passkeys.

    For example, if Troy Hunt had been warned that he had never visited mailchimp-sso.com before, he probably would not have fallen for their trap (troyhunt.com/a-sneaky-phish-ju).

    If a website unexpectedly sends a new certificate to the browser, this *could* be a red flag if the site used an OV or EV certificate before, and suddenly a DV cert - in that case you have no way to tell who the (current) owner is of a domain name (and website).

    Be my guest if you want to use a DV cert for your home NAS (where you *know* the domain name, regardless what it looks like) or for some dumb webshop. As a visitor of the latter there's no way to know who to sue in case you get deceived.

    Authenticity requires knowing, with an amount of certainty (always < 100%), who the owner is. It's all about risk management.

    @cendyne @soatok

    #Phishing #FakeWebsites #Authenticity #Authentic #Passkeys

  2. @timcappalli : and IMO it's a HUGE problem that paskeys are advertised using BULL SHIT.

    What makes passkeys phishing resistant is that (the most important part of) the domain name stored with the passkey's private key on your device must match the domain name shown in the browser's address bar *AND* https must be in use.

    And typically passkeys *do not* "stay" on your device as they are usually backed up to cloud storage.

    #Phishing #Passkeys #PasskeyCreation #FakeWebsites

  3. @timcappalli : you (and Capital One) forgot to mention the most important thing:

    WHEN CREATING A PASSKEY: TRIPLE-CHECK THAT YOU'RE ON A WEBSITE USING THE *CORRECT* DOMAIN NAME!

    There is ZERO phishing-resistance while CREATING a passkey.

    #Phishing #Passkeys #PasskeyCreation #FakeWebsites