0

One of the recommendations to prevent phishing using look-alike domain names (like www.google.com.phishing.org or IDN homograph attacks) is to use a password manager or a physical security token like a YubiKey, because since it records the domain and username associated to a password to autocomplete it, it won't autocomplete those fields if the domain name is incorrect.

That solution seems rather strange to me, because it looks like a hack: it is not the primary usecase of those tools. Indeed, the tool's ability to store passwords is useless in this particular case, though it's its primary usecase. However, it still is an interesting solution, that should work in a lot of situations.

So why are there no browser feature or extension that would offer to record trusted domain names, and display something when you're on the right domain name, like the "lock" icon for HTTPS or the "star" icon for favorites?

It would be simpler to configure, use and maintain, without requiring to store passwords.

What would be the drawbacks of such tool?

  • 1
    how would it know what is a "correct" domain? – schroeder Nov 12 '18 at 11:13
  • It wouldn't know: it would only know if a particular domain name was recorded as "trusted" by the user. The user could record it during its registration to this domain's website, for example. If, later, the user thinks he is on that trusted website, but the browser says that its domain name is unknown (because it was not recorded as "trusted"), the user should be suspicious. – CidTori Nov 12 '18 at 11:22
  • there are plugins that do this - lots, actually – schroeder Nov 12 '18 at 11:23
  • Well in that case I'm not searching with the right keywords, because I can't find any. Could you name me at least one of them, or the keywords you used to find them, so I can take a look? – CidTori Nov 12 '18 at 11:27
  • "browser plugin trusted domain" is the search term I just used and there were a lot of hits ... plus all the options that I list in my answer below – schroeder Nov 12 '18 at 11:44
2

There are and you mentioned one: favourites. Favourite or bookmarks do exactly what you want. But I suppose that you feel that there is a problem with that as a solution, and there is.

The problem has to do with the balance of security and convenience. You want something that is effective but does not reduce your ability to do what you want. A solution has to provide clear information, but not be in the way. You would quickly uninstall a plugin that showed a banner on every website that was not in your trusted list. You also do not want something that the user will easily overlook. So it has to be out of the way until it becomes relevant. Knowing when to be relevant is a massive problem to solve.

Here is what has been tried and is available even today:

Before password managers, the advice was to bookmark the sites you went to and to check for the star before you entered a password. This was about as successful as you would imagine (not very). It required that people voluntarily remembered to check before entering passwords.

Browsers themselves had built-in tools, like IE's "Trusted Sites" list. It displayed an icon in the bar. But that had the same problem: it required that users check for the icon.

Then there came cookies that allowed you to remain logged in so that you never had to type in your password ("keep me logged in"). If you had to log in, something was suspicious. This became a massive vulnerability because cookies could be stolen.

TLS certificates used to be expensive so the advice for a long time was "if you see the green lock in the URL bar, then you know it is trusted". This was fine until certificates became free and, like favourites, it required the user to voluntarily check for the lock. Malicious actors would also leverage valid sites using TLS to host their malicious pages (or use Google Docs).

Then, in the corporate environment, there were whitelists. This was extremely successful to prevent phishing, but awful in terms of employee happiness. You can still get browser extensions that use the whitelist idea.

Then there were the "reputation circles" and other reputation-based methods. A browser extension allowed users from around the world to rate sites. This was much better than whitelisting, but then malicious actors poisoned the ranking system and allowed malicious sites to be trusted.

To improve on that, DNS services used their info to provide reputation services, and there are many used today. You can get these DNS reputation plugins for any browser. The problem here is that it is up to the DNS provider to recognize and rate a site appropriately. Malicious actors are actively finding ways to evade their algorithms.

Password manager plug-ins are the best way to protect yourself from this problem, and it is not a "hack" but a defined feature of browser-based password managers. You set a password that you cannot remember yourself, you get the password manager to do it for you, and if it doesn't, you do not just know that something is wrong, but you are prevented from entering the data that you do not know. Offline password managers cannot do this for you.

An online, in-browser password manager is completely out of the way until the very point where it is needed. It is unobtrusive, and provides a barrier that is difficult to get past without a lot of effort. It defines the list of relevant, trusted sites, and offers both convenience and security. That's why they are so highly recommended, especially for non-technical users.

  • 1
    Thanks for your detailed and interesting answer. "you do not just know that something is wrong, but you are prevented from entering the data that you do not know": indeed, it's way better than what I proposed, and justifies the use of a password manager for that purpose and why my solution is not widely used. – CidTori Nov 12 '18 at 14:01
  • Just to add some clarifications: Bookmarks do not do "exactly" what I want: they are based on the entire URL, while I'd want a solution to only check the domain name. Indeed, if you are not on the specific page that you bookmarked, you are not notified that you bookmarked one page of that domain. What do you mean by "offline password managers" ? Do you mean Keepass-like (local vault) or Lesspass-like (generator)? Since the only feature used here is the auto-filling of credentials, I don't see what prevents any of them to do so in theory. – CidTori Nov 12 '18 at 14:09
  • Keepass is an example of an offline password manager – schroeder Nov 12 '18 at 14:12
  • Then it seems that Kee, can auto-fill credentials based on the URL while using a local KeePass vault. – CidTori Nov 12 '18 at 14:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.