A website asks you to enter a Microsoft/Google/Facebook password. How do you know it is safe?

Question

A website prompts me to log in to my Microsoft Account. In order to perform my task, it requires me to enter that password.

How does the "average user" avoid giving all their login details to a malicious website?

---

For example, I came across someone's personal website. I wish to download some music, but...

Can't download multiple files simultaneously despite following OneDrive's documentation

The first step of the instructions says: "on your OneDrive".

To download multiple files, you must be logged in to OneDrive with your Microsoft account.

Answer 1

I used to write training material for this exact problem, as one of our clients had very poor email security, and our most effective material were posters posted in high-trafic areas that trained users to recognize the domain name of the page asking for a password.

Modern browsers highlight the domain part of the URL specifically for this purpose:

We instructed users to specifically check that the darker text was a website they were definitely 100% sure was tied to the service they were attempting to log into.

To put a grain of salt on this, this was after several years of abysmal security practices, where users would recieve emails from unknown adresses, click the .html attachment that mimicked the microsoft login page and stole the credentials. After several instances of "I hear clarice from accounting got hacked!", users were understandably more cooperative in being sure they wouldn't be the next person to be hacked than your average user.

Modern login systems (such as 2FA, passkeys and centralized auth poviders like okta) provide additional (not complete!) security that foils the basic attacks that generally take place with phishing.

The solution provided by SourceJedi is somewhat valid, unfortunately Microsoft in their infinite wisdom are apparently unable to create a login system that correctly remembers your previous login, on top of registering domains that sound exactly like what a phisher thinks might work.

Answer 2

1. Passkeys can solve this. A passkey can only be used on the website you created it for. When logging in on a PC, you can also use a passkey stored on your phone.[1]

2. Password managers are also available from your existing web browser (or OS). A password manager will only auto-fill a password on the website you saved it for, or on a website which it knows to be equivalent.[2] This is why secure auto-fill is useful.

It is not always possible to log in using auto-fill. For example, a user might be switching to a new device, after using a very popular device which does not support exporting passwords.[3][4]

The simplest alternative to explain is (sadly):

1. Search for the name of the service, e.g. Microsoft OneDrive.
2. Try to avoid tapping a deceptive advert at the top of the results.
3. Hope that the web search result shows you the real website, and use that to enter your credentials.
4. For future use, you can accept the browser's offer to save the entered password (or create a passkey).
5. Re-load the original web page. It should now show you as logged in. Alternatively, it might still show a log in button, but this should now let you log in without entering a password or other credentials.
6. Now complete your task :-).

This should be safer than accepting the original sign-in request.

For important accounts, it would be great if people could save trusted bookmarks on first use. And/or double-check it is real e.g. using a second search engine, and confirming the website is already bookmarked.

(Attacks are also reduced because the main web browsers block known malicious sites. This might have improved over time, but it will never be perfect.[5])

Answer 3

Check the browser address bar carefully

Browsers nowadays highlight the main domain in the address, and attempt to ensure there are no tricks with e.g. lookalike characters from foreign symbols.

This takes a bit of learning to recognize the domains that are genuine, as for example Microsoft uses the not necessarily obvious "live.com" as the domain for their login system.

For the average user who just wants to get things done, the biggest risk is that when things do not work, they'll discard security advice. This approach is commonly used in phishing, by creating stress for the user and then presenting a login form that just doesn't care whether you are already logged into live.com in another tab. Having a wrong domain in the login form could at least give some clue to it being a scam, even though that is also easy to ignore when you are in a hurry.