Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Is the solution to preventing credential phising attacks is really only 'educating' people about it?
For the sake of this question, let us assume that I have a web application that takes a username and a password within a login form. Currently, as far as I know and could figure out, there is no way I can avoid an attacker phishing a vulnerable user of my web application into filling up a phished version of the login form prepared by an attacker.
What you need is that the use of credentials is bound to the accessed domain or that the actual credentials are not transferred at all.
On the client side this can be achieved by using a password manager which stores the credentials for the domain and will only fill in the credentials if it matches the stored domain.
From the perspective of the web application this can be achieved by using authentication with client certificates. In order to steal these the attacker would need to get access to the clients private key, which is only accessible on the clients system and can not be retrieved with man in the middle or credential phishing attacks. Also, modern authentication methods like WebAuthn provide a comfortable way for the user to authenticate (no password needed) and similar to client certificates makes it impossible for an attacker to steal the credentials with a phishing attack. Another method would be the use of the Digest Authentication built into the browser instead of creating your own login form. In this case no password is transferred but instead the client proves that it knows the password with some challenge-response method. Unfortunately the server has to store the plain password or some equivalent in order to verify the users response.
