Hot answers tagged

53

A scenario such banks might want to protect you from could be this: you visit your banking website and do your banking stuff. after you are finished you log out and then navigate to some other website to look at cat pictures or whatever. you leave your computer with the cat picture website open. Because there is nothing incriminating on your screen, you ...


35

Why security indicators fail vs. phishing There is no action that can be taken that is economically viable. Put another way, it's too effortful to defend against phishing attacks. See 'So long and no thanks for the externalities' for an example on the US economy and information workers. You are correct that checking for URL correctness is error-prone, and ...


25

I was going to suggest that ensuring that the login screen for the online banking system showed the name of the bank in green, in the address bar might work. But then I started wondering if any of the local banks I know about did that properly. It's less encouraging than I'd hoped. For these nine fairly large banks, 6 provide the name of the bank in the ...


25

There's a couple of things going on here: Bankings sites will use cache-control headers to forbid cacheing of the pages. So when you click back the browser has to reload the page from the server. Some parts of the site may have a strict flow of pages, e.g. you enter transaction details, enter your SMS code, view transaction confirmation. These require ...


7

This isn't as common now, but quite some time ago a lot of websites were just HTML wrappers around classic terminal (IBM 3270 and the like) applications which were being scraped statefully, and this was especially prevalent in legacy industries where the whole idea of a separation between view and model is very, very new. It's possible that a lot of banking ...


2

Essentially your question is one of authentication. In this case, it's users authenticating the bank website is actually the bank. I think you're right, and the user is going to have difficulty in authenticating the bank through the URL (many banks have multiple URLs for instance). You're also correct that users aren't terribly sophisticated about URLs, ...


1

I like to rely on the auto-fill feature of my password manager for this check. The rationale is that I will not be clever enough to match the site URL in the browser to the expected one, while a password manager will. So when I see that it has filled in the entry for the site - the site is genuine, otherwise I should start to worry. The password manager ...


1

A proxy is better for that. I think if you configure this proxy but skip the SSL cert configuration you should get your answer.



Only top voted, non community-wiki answers of a minimum length are eligible