My (U.S., R1) academic institution uses CAS (Central Authentication Service) to authenticate almost all our web services.

However, they don't use CAS for our GitHub Enterprise instance. Instead they use LDAP, so the login page says "GitHub Enterprise", and there is nothing to indicate it's an official page of our institution except that the URL is under our .edu domain.

Beyond the fact that this bypasses our Duo 2FA deployment, I'm concerned that presenting users with a login page that expects their CAS password but isn't the normal CAS login page encourages phishing attacks by diluting the message of only putting your password into clearly official, institutionally-affiliated websites.

Is this valid, and is it worth raising with our campus IT department? (I'm a graduate student.)

  • I don't think so. Phishing attacker can clone the CAS page without any trouble. – ThoriumBR May 23 at 16:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.