New answers tagged

1

I like to rely on the auto-fill feature of my password manager for this check. The rationale is that I will not be clever enough to match the site URL in the browser to the expected one, while a password manager will. So when I see that it has filled in the entry for the site - the site is genuine, otherwise I should start to worry. The password manager ...


2

A simple short answer is that yes that does happen. A better answer is that before you download anything suspect you should really be verifying the source first. Lets say you have found a fixit tool for registry errors, lets call this tool "CCLeaner." Now, before I would consider downloading CCleaner from any source I would first google CCleaner to verify it ...


3

I wouldn't expect a reputable security advice site to intentionally link to live malware or contain live malware. There are plenty of sites out there that are less than reputable who will be visible in your search results if you do a search for "Halp, I'm infected with ABC" or "Is NotAVirusHonest.exe safe?". I'd be very careful about trusting both the ...


3

Do technical advice sites often link to malware? This seems very broad. How can we easily check the majority of these websites and find which advice is malicious, and which isn't? And then there's all the advertisements on the website. They can if they want. Contributors can if they want to. A far better method of deceiving you is making you believe ...


5

In my experience, though it is uncommon to find malware embedded in these fix it scripts and registry keys, it does happen. As such, I would highly recommend most users getting these types of patches and assistance from the vendor directly. An experienced security professional could download the fix it script or registry key, open it and view it first, ...


1

You have two basic things you need to address: 1) Do you meet the current best practices for Information Security in your organization? There are several good resources including the Microsoft Security Baseline Analyzer, and using resources such as NIST and SANS. If your organization is large enough for an AD environment, they likely need and should ...


0

Steve DM's answer (checking and bookmarking the page) is better from an absolute security standpoint, but another viable (and possibly more user friendly) option is to tell them to Google the bank every time instead of clicking on a link. This way, you rely on Google taking you to the right place rather than some shady link and your observational skills. ...


0

The best way to explain the value of a security enhancement to an IT person is to describe the attack(s) that the enhancement prevents. The best way to explain the value of a security enhancement to an executive is to mention the attack(s) you are preventing and an estimate of the cost to your organization if the attack(s) were to occur, compared to the ...


2

Essentially your question is one of authentication. In this case, it's users authenticating the bank website is actually the bank. I think you're right, and the user is going to have difficulty in authenticating the bank through the URL (many banks have multiple URLs for instance). You're also correct that users aren't terribly sophisticated about URLs, ...


25

I was going to suggest that ensuring that the login screen for the online banking system showed the name of the bank in green, in the address bar might work. But then I started wondering if any of the local banks I know about did that properly. It's less encouraging than I'd hoped. For these nine fairly large banks, 6 provide the name of the bank in the ...


35

Why security indicators fail vs. phishing There is no action that can be taken that is economically viable. Put another way, it's too effortful to defend against phishing attacks. See 'So long and no thanks for the externalities' for an example on the US economy and information workers. You are correct that checking for URL correctness is error-prone, and ...


-2

Yes. Use an app that is definitely connecting to the site. Or. Check the https. Verify the url. Make sure the url is short enough to visually see tampering. Also, maybe some examples of homographic attacks.


0

If UAC is enabled, all the programs run with the same permissions as a normal user. A process only runs as admin when: You approved UAC. Changing Windows settings with the UAC shield next to them (it doesn't ask for confirmation on an admin account, depending on your UAC settings). You invoke the runas command and typed your password. You ...


1

I think it's best to have an automated message thru IVR telling them explicitly that- For security purposes please never provide your passwords to our Help desk Representatives ... before they even talk to your support team. I hope it helps! :)


0

I work for a help desk, and we recently launched an online service where our members can log in. It is unfortunate that a design problem rears its head and you, at the frontlines, have to deal with it, when it should be the architects who should have to answer to the feedback provided in this QA. I note two things (emphasis mine): A problem we are ...


0

People are used to trusting the people that they ask for help, else they would not ask them... Doctors, therapists, auto repair, appliance service, etc. For example, yesterday I took my car in to the shop for a repair. It would be absurd if they said, "Do NOT under any circumstances give any of our staff (or any other person) the key to your car!" Inside my ...


2

Usually it is a symptom of poor communication, procedures, organisiation, policies and strategies by the company toward the customer. For some of my bank acounts, even I can't understand what the 'letter' or 'email' is on about between the Pin, security phrase, security number, password, customer ID, login name, login name, email address, email address and ...


0

I suggest you back up and ask yourself why the users are doing this in the first place. What occurs to me is that they can't log in, and are trying to determine if they forgot their password or something else is wrong - the account is blocked, they have the wrong user name, etc. Your problem is that the innocent user trying to fix his access problem is ...


-1

If all the security awareness measures mentioned in this thread are not sufficient you could try one or more of the following: Introduce one-time passwords using a RSA-token, Yubikey or similar (No smartphone magic please). Introduce a second factor with the tools named above. Introduce smart cards for authentication. I fear that there's a high risk of ...


-1

The risk here seems to lie more on the side of the help desk technicians who are getting told the password. If you can't trust them not to abuse the knowledge then, you have a problem to fix. Getting users to stop giving their password is a matter of educating them. That should happen as needed when it occurs. If a user gives a password to a help desk ...


2

Another one coming from the left field, trying to stop the leak, rather than mopping the floor. If your password contains letters and numbers, quite often we get a lot of problems with non monotype fonts. '1' 'i' 'l' all looks the same '0' 'O' also. So perhaps use a picture, or force the browser to use monotype, when displaying their pass? Or get your pass ...



Top 50 recent answers are included