22

A website prompts me to log in to my Microsoft Account. In order to perform my task, it requires me to enter that password.

How does the "average user" avoid giving all their login details to a malicious website? What would you tell them to do?

For example, I came across someone's personal website. I want to download this Marathon Phoenix soundtrack. I tap the link for "upmastered FLAC". This takes the user to a file storage website, titled "OneDrive". And then...

Can't download multiple files simultaneously despite following OneDrive's documentation

The first step of the instructions says: "on your OneDrive".

To download multiple files, you must be logged in to OneDrive with your Microsoft account.

Improve this question
4
  • 10
    Not making this an answer because it's more of a cynical non-answer, and there is plenty of room for more useful responses, but: they don't. Average users in the modern web security environment are [at a disadvantage]. If they get saved, it's because the browsers and the major identity providers conspire to catch this kind of thing on their end, and prevent the users' mistakes from getting their accounts hacked.
    – Glenn Willen
    Commented Dec 11 at 17:35
  • 2
    @GlennWillen please keep things to professional language
    – schroeder ♦
    Commented Dec 12 at 8:52
  • I was not aware the process works that way (I never use those "third party logins"). The only comparison I have is a paypal payment initiated from a web store; in that case, paypal opens a separate dialog from paypal. The information passed on to the store does not contain secrets. I may be naive, but: Those sites ask you to enter your, say, Microsoft password on a page with an unrelated (to Microsoft) URL?? That seems entirely ... something you shouldn't do.
    – Peter - Reinstate Monica
    Commented Dec 12 at 16:59
  • @Peter-ReinstateMonica edited. Have a look and see. (If you are already logged in to your live.com account, you could use a fresh private browsing session to see the logged-out version ;-).
    – sourcejedi
    Commented Dec 12 at 19:34

4 Answers 4

Reset to default
22

I used to write training material for this exact problem, as one of our clients had very poor email security, and our most effective material were posters posted in high-trafic areas that trained users to recognize the domain name of the page asking for a password.

Firefox highlights the domain part of the URL specifically for this purpose:

a browser's URL bar

We instructed users to specifically check that the darker text was a website they were definitely 100% sure was tied to the service they were attempting to log into.

To put a grain of salt on this, this was after several years of abysmal security practices, where users would recieve emails from unknown adresses, click the .html attachment that mimicked the microsoft login page and stole the credentials. After several instances of "I hear clarice from accounting got hacked!", users were understandably more cooperative in being sure they wouldn't be the next person to be hacked than your average user.

Modern login systems (such as 2FA, passkeys and centralized auth poviders like okta) provide additional (not complete!) security that foils the basic attacks that generally take place with phishing.

The solution provided by SourceJedi is somewhat valid, unfortunately Microsoft in their infinite wisdom are apparently unable to create a login system that correctly remembers your previous login, on top of registering domains that sound exactly like what a phisher thinks might work.

Improve this answer
9
  • 6
    The the OP asking about the legitimacy of the main site or the window popping up for the creds for the MS/Google/Facebook account for SSO? there isn;t often an address bar on those.
    – schroeder ♦
    Commented Dec 11 at 11:37
  • 2
    @preferred_anon Edge seems to be highlighting the entire domain for me (subdomain included) rather than just the root+tld that the screenshot shows. Google Chrome, also seems to be doing that, although with much lower contrast (at least in dark mode), and without the scheme being visible. (this is all on windows 10)
    – Justinw
    Commented Dec 11 at 13:48
  • 3
    @Michael Firefox is clearer than Chromium in its highlighting, but both do highlight (FF's grey is pale enough that reading the rest of the URL could get tricky with vision difficulties). Chromium highlights the subdomain as well
    – Chris H
    Commented Dec 11 at 16:58
  • 2
    In case of vision deficiency, it is recommended to click the lock icon to the left of the URL, which popup will show only the non-grayed domain part at the top, at least in Edge.
    – Ray
    Commented Dec 12 at 1:18
  • 3
    Only U2F/FIDO2 is going to help. Other forms of 2FA like OATH, SMS, push can be proxied. And the Firefox highlighting is problematic on shared domains you find in cloud providers (foo.onmicrosoft.com, foo.s3.region.amazonaws.com), the Safari version where it only shows e.g. security.stackexchange.com in the address bar I think is better.
    – user71659
    Commented Dec 12 at 3:30
14

  1. Passkeys can solve this. A passkey can only be used on the website you created it for. When logging in on a PC, you can also use a passkey stored on your phone.[1]

  2. Password managers are also available from your existing web browser (or OS). A password manager will only auto-fill a password on the website you saved it for, or on a website which it knows to be equivalent.[2] This is why secure auto-fill is useful.

It is not always possible to log in using auto-fill. For example, a user might be switching to a new device, after using a very popular device which does not support exporting passwords.[3][4]

The simplest alternative to explain is (sadly):

  1. Search for the name of the service, e.g. Microsoft OneDrive.
  2. Try to avoid tapping a deceptive advert at the top of the results.
  3. Hope that the web search result shows you the real website, and use that to enter your credentials.
  4. For future use, you can accept the browser's offer to save the entered password (or create a passkey).
  5. Re-load the original web page. It should now show you as logged in. Alternatively, it might still show a log in button, but this should now let you log in without entering a password or other credentials.
  6. Now complete your task :-).

This should be safer than accepting the original sign-in request.

For important accounts, it would be great if people could save trusted bookmarks on first use. And/or double-check it is real e.g. using a second search engine, and confirming the website is already bookmarked.

(Attacks are also reduced because the main web browsers block known malicious sites. This might have improved over time, but it will never be perfect.[5])

Improve this answer
5
  • 6
    So ... Make sure you're logged into that account first.
    – schroeder ♦
    Commented Dec 10 at 21:34
  • 10
    Why involve a search engine at all, and risk all the potential attacks through malicious ads and accidental misclicks? Browsers still have address bars, don't they, so you just use that and replace steps 1-3 by typing google.com or microsoft.com or whatever into the address bar and logging in there.
    – TooTea
    Commented Dec 11 at 10:48
  • I was thinking en.wikipedia.org/wiki/Typosquatting . I guess you're right that's a smaller risk, partly because typosquatters of these very popular services will get blocklisted very quickly.
    – sourcejedi
    Commented Dec 11 at 11:12
  • Just a warning, the build-in password manager at least in Microsoft Edge does not work for this. On my work computer I told Edge to remember my login and password for website A and to not remember my credentials for website B. Now whenever I manually put in my login and password for website B Edge tries to autofill the login and password from website A.
    – quarague
    Commented Dec 13 at 18:52
  • @quarague Phishing protection is certainly an advertised feature. I haven't tried Edge myself though. learn.microsoft.com/en-us/deployedge/…
    – sourcejedi
    Commented Dec 13 at 22:19
5

Check the browser address bar carefully

Example address bar for live.com login

Browsers nowadays highlight the main domain in the address, and attempt to ensure there are no tricks with e.g. lookalike characters from foreign symbols.

This takes a bit of learning to recognize the domains that are genuine, as for example Microsoft uses the not necessarily obvious "live.com" as the domain for their login system.

For the average user who just wants to get things done, the biggest risk is that when things do not work, they'll discard security advice. This approach is commonly used in phishing, by creating stress for the user and then presenting a login form that just doesn't care whether you are already logged into live.com in another tab. Having a wrong domain in the login form could at least give some clue to it being a scam, even though that is also easy to ignore when you are in a hurry.

Improve this answer
6
  • 1
    The the OP asking about the legitimacy of the main site or the window popping up for the creds for the MS/Google/Facebook account for SSO? there isn;t often an address bar on those.
    – schroeder ♦
    Commented Dec 11 at 11:59
  • 3
    @schroeder That sounds weird, and I definitely wouldn't input my credentials to any popup without address bar. I also wouldn't input e.g. Microsoft SSO login info to a main site of some 3rd party.
    – jpa
    Commented Dec 11 at 13:15
  • 2
    @schroeder ah, do you mean like this? drive.google.com/file/d/1iirGqJbA5KzK6BNAUxna-WypDZM-GST2/… I think Firefox always shows a URL for popups now, for this reason. Apparently so does IE7; it's an old change: gtalbot.org/BugzillaSection/…
    – sourcejedi
    Commented Dec 11 at 14:56
  • @jpa no MS Teams desktop client for you then - or at least not trivially. The main window has no address bar, and acts as a popup that could be spoofed fairly easily when clicking on a "join meeting" link. If you want to use the desktop client for meeting links you have to remember to sign into it first.
    – Chris H
    Commented Dec 11 at 16:36
  • 2
    @jpa we've had some backend changes recently, and the login is in the main Teams window (Linux client); the issue is mainly if something else spawns Teams. But bad design from those who should know better is disturbingly common. I've had to complain to my bank recently (and got nowhere) because they send an email including both "We won't sent you a link to log in" and a link that takes you to a page with a big login button - and misleading content that makes you want to log in and check details
    – Chris H
    Commented Dec 11 at 19:06
1

I would never put a username and password into a website that is not the site with which they are registered. Like ever.

Now it is common for things like single sign on to let you "identify yourself" with your google/github etc account, and they will be using a system like OpenID connect. These systems are designed to external services to perform a limited set of actions on your behalf - these actions might just be "know you email address" or "update your github profile".

With OIDC you will always enter your username and password on a website owned by the identity provider (ie google, github), and that website should state what permissions you are granting the service which wants to act on your behalf.

The OIDC handshake gives the external service an access token that can be used to make a limited set of API requests to your identity provider, the external service doesnt see your username and password.

Improve this answer
New contributor
J. Filik is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .