Podcast #128: We chat with Kent C Dodds about why he loves React and discuss what life was like in the dark days before Git. Listen now.
2 added 369 characters in body
source | link

If the email includes a link, there are some basic checks you can do by opening it in a private browsing window.

CheckMake sure your private browsing window is as secure as possible before starting. At a minimum, make sure your browser is fully updated. You may also wish to disable Javascript, run the browser in a sandbox such as Firejail, or even isolate it in a virtual machine (using VirtualBox or similar).

Now open the link in the private browsing window. Once the page loads, check the address bar. Make sure the hostname (in modern browsers this part of the address is usually darker than the rest) matches the site you expected to reach. The most important part of the hostname (and the hardest for an attacker to impersonate) is the part at the end, from the organisation name onwards. So if the link you've got in your bookmarks is www.facebook.com, then login.facebook.com is probably OK, but www.facebook.example.com or www.facebook.biz is not.

Check that the site has a valid certificate - on most modern browsers, there is a green padlock in or near the address bar. If it's missing, red, yellow, or grey, then you probably shouldn't log into this site, even if you are able to prove it is the correct address.

Next, if the page you reach has a login option, use it, but with non-working credentials. Phishing attacks will typically not make any attempt to validate the credentials you enter, whereas a real site would. If it doesn't alert you that the credentials were invalid, it's probably a phishing attack.

And finally, if you can avoid using the link in the email, then do. If you've got a link to the site in your bookmarks, or you can get hold of a trusted address in some other way, log in using that address instead.

If the email includes a link, there are some basic checks you can do by opening it in a private browsing window.

Check the address bar. Make sure the hostname (in modern browsers this part of the address is usually darker than the rest) matches the site you expected to reach. The most important part of the hostname (and the hardest for an attacker to impersonate) is the part at the end, from the organisation name onwards. So if the link you've got in your bookmarks is www.facebook.com, then login.facebook.com is probably OK, but www.facebook.example.com or www.facebook.biz is not.

Check that the site has a valid certificate - on most modern browsers, there is a green padlock in or near the address bar. If it's missing, red, yellow, or grey, then you probably shouldn't log into this site, even if you are able to prove it is the correct address.

Next, if the page you reach has a login option, use it, but with non-working credentials. Phishing attacks will typically not make any attempt to validate the credentials you enter, whereas a real site would. If it doesn't alert you that the credentials were invalid, it's probably a phishing attack.

And finally, if you can avoid using the link in the email, then do. If you've got a link to the site in your bookmarks, or you can get hold of a trusted address in some other way, log in using that address instead.

If the email includes a link, there are some basic checks you can do by opening it in a private browsing window.

Make sure your private browsing window is as secure as possible before starting. At a minimum, make sure your browser is fully updated. You may also wish to disable Javascript, run the browser in a sandbox such as Firejail, or even isolate it in a virtual machine (using VirtualBox or similar).

Now open the link in the private browsing window. Once the page loads, check the address bar. Make sure the hostname (in modern browsers this part of the address is usually darker than the rest) matches the site you expected to reach. The most important part of the hostname (and the hardest for an attacker to impersonate) is the part at the end, from the organisation name onwards. So if the link you've got in your bookmarks is www.facebook.com, then login.facebook.com is probably OK, but www.facebook.example.com or www.facebook.biz is not.

Check that the site has a valid certificate - on most modern browsers, there is a green padlock in or near the address bar. If it's missing, red, yellow, or grey, then you probably shouldn't log into this site, even if you are able to prove it is the correct address.

Next, if the page you reach has a login option, use it, but with non-working credentials. Phishing attacks will typically not make any attempt to validate the credentials you enter, whereas a real site would. If it doesn't alert you that the credentials were invalid, it's probably a phishing attack.

And finally, if you can avoid using the link in the email, then do. If you've got a link to the site in your bookmarks, or you can get hold of a trusted address in some other way, log in using that address instead.

1
source | link

If the email includes a link, there are some basic checks you can do by opening it in a private browsing window.

Check the address bar. Make sure the hostname (in modern browsers this part of the address is usually darker than the rest) matches the site you expected to reach. The most important part of the hostname (and the hardest for an attacker to impersonate) is the part at the end, from the organisation name onwards. So if the link you've got in your bookmarks is www.facebook.com, then login.facebook.com is probably OK, but www.facebook.example.com or www.facebook.biz is not.

Check that the site has a valid certificate - on most modern browsers, there is a green padlock in or near the address bar. If it's missing, red, yellow, or grey, then you probably shouldn't log into this site, even if you are able to prove it is the correct address.

Next, if the page you reach has a login option, use it, but with non-working credentials. Phishing attacks will typically not make any attempt to validate the credentials you enter, whereas a real site would. If it doesn't alert you that the credentials were invalid, it's probably a phishing attack.

And finally, if you can avoid using the link in the email, then do. If you've got a link to the site in your bookmarks, or you can get hold of a trusted address in some other way, log in using that address instead.