14

A website prompts me to log in to my Microsoft Account. In order to perform my task, it requires me to enter that password.

How does the "average user" avoid giving all their login details to a malicious website?

For example, I came across someone's personal website. I wish to download some music, but...

Can't download multiple files simultaneously despite following OneDrive's documentation

The first step of the instructions says: "on your OneDrive".

To download multiple files, you must be logged in to OneDrive with your Microsoft account.

Improve this question
3
  • 6
    Not making this an answer because it's more of a cynical non-answer, and there is plenty of room for more useful responses, but: they don't. Average users in the modern web security environment are [at a disadvantage]. If they get saved, it's because the browsers and the major identity providers conspire to catch this kind of thing on their end, and prevent the users' mistakes from getting their accounts hacked.
    – Glenn Willen
    Commented 17 hours ago
  • @GlennWillen please keep things to professional language
    – schroeder ♦
    Commented 1 hour ago
  • @schroeder may I please ask what part of Glenn Willen’s comment includes unprofessional language? Not that I am challenging your judgment, I just want to clarify why, so that myself and others can learn how to avoid apparent mistakes in the future.
    – security_paranoid
    Commented 1 hour ago

3 Answers 3

Reset to default
9

I used to write training material for this exact problem, as one of our clients had very poor email security, and our most effective material were posters posted in high-trafic areas that trained users to recognize the domain name of the page asking for a password.

Firefox highlights the domain part of the URL specifically for this purpose:

a browser's URL bar

We instructed users to specifically check that the darker text was a website they were definitely 100% sure was tied to the service they were attempting to log into.

To put a grain of salt on this, this was after several years of abysmal security practices, where users would recieve emails from unknown adresses, click the .html attachment that mimicked the microsoft login page and stole the credentials. After several instances of "I hear clarice from accounting got hacked!", users were understandably more cooperative in being sure they wouldn't be the next person to be hacked than your average user.

Modern login systems (such as 2FA, passkeys and centralized auth poviders like okta) provide additional (not complete!) security that foils the basic attacks that generally take place with phishing.

The solution provided by SourceJedi is somewhat valid, unfortunately Microsoft in their infinite wisdom are apparently unable to create a login system that correctly remembers your previous login, on top of registering domains that sound exactly like what a phisher thinks might work.

Improve this answer
New contributor
Themoonisacheese is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
7
  • 5
    The the OP asking about the legitimacy of the main site or the window popping up for the creds for the MS/Google/Facebook account for SSO? there isn;t often an address bar on those.
    – schroeder ♦
    Commented 23 hours ago
  • 2
    @preferred_anon Edge seems to be highlighting the entire domain for me (subdomain included) rather than just the root+tld that the screenshot shows. Google Chrome, also seems to be doing that, although with much lower contrast (at least in dark mode), and without the scheme being visible. (this is all on windows 10)
    – Justinw
    Commented 20 hours ago
  • 1
    @schroeder in fact, one doesn't even know the whole popup is real or faked unless one is able to chose the browser to use (if we try to authenticate to an non-web app, e.g. Teams).
    – Haukinger
    Commented 19 hours ago
  • 1
    @Michael Firefox is clearer than Chromium in its highlighting, but both do highlight (FF's grey is pale enough that reading the rest of the URL could get tricky with vision difficulties). Chromium highlights the subdomain as well
    – Chris H
    Commented 17 hours ago
  • 1
    In case of vision deficiency, it is recommended to click the lock icon to the left of the URL, which popup will show only the non-grayed domain part at the top, at least in Edge.
    – Ray
    Commented 9 hours ago
7

  1. Passkeys can solve this. A passkey can only be used on the website you created it for. When logging in on a PC, you can also use a passkey stored on your phone.[1]

  2. Password managers are also available from your existing web browser (or OS). A password manager will only auto-fill a password on the website you saved it for, or on a website which it knows to be equivalent.[2] This is why secure auto-fill is useful.

It is not always possible to log in using auto-fill. For example, a user might be switching to a new device, after using a very popular device which does not support exporting passwords.[3][4]

The simplest alternative to explain is (sadly):

  1. Search for the name of the service, e.g. Microsoft OneDrive.
  2. Try to avoid tapping a deceptive advert at the top of the results.
  3. Hope that the web search result shows you the real website, and use that to enter your credentials.
  4. For future use, you can accept the browser's offer to save the entered password (or create a passkey).
  5. Re-load the original web page. It should now show you as logged in. Alternatively, it might still show a log in button, but this should now let you log in without entering a password or other credentials.
  6. Now complete your task :-).

This should be safer than accepting the original sign-in request.

For important accounts, it would be great if people could save trusted bookmarks on first use. And/or double-check it is real e.g. using a second search engine, and confirming the website is already bookmarked.

(Attacks are also reduced because the main web browsers block known malicious sites. This might have improved over time, but it will never be perfect.[5])

Improve this answer
3
  • 6
    So ... Make sure you're logged into that account first.
    – schroeder ♦
    Commented yesterday
  • 7
    Why involve a search engine at all, and risk all the potential attacks through malicious ads and accidental misclicks? Browsers still have address bars, don't they, so you just use that and replace steps 1-3 by typing google.com or microsoft.com or whatever into the address bar and logging in there.
    – TooTea
    Commented 23 hours ago
  • I was thinking en.wikipedia.org/wiki/Typosquatting . I guess you're right that's a smaller risk, partly because typosquatters of these very popular services will get blocklisted very quickly.
    – sourcejedi
    Commented 23 hours ago
3

Check the browser address bar carefully

Example address bar for live.com login

Browsers nowadays highlight the main domain in the address, and attempt to ensure there are no tricks with e.g. lookalike characters from foreign symbols.

This takes a bit of learning to recognize the domains that are genuine, as for example Microsoft uses the not necessarily obvious "live.com" as the domain for their login system.

For the average user who just wants to get things done, the biggest risk is that when things do not work, they'll discard security advice. This approach is commonly used in phishing, by creating stress for the user and then presenting a login form that just doesn't care whether you are already logged into live.com in another tab. Having a wrong domain in the login form could at least give some clue to it being a scam, even though that is also easy to ignore when you are in a hurry.

Improve this answer
6
  • 1
    The the OP asking about the legitimacy of the main site or the window popping up for the creds for the MS/Google/Facebook account for SSO? there isn;t often an address bar on those.
    – schroeder ♦
    Commented 22 hours ago
  • 2
    @schroeder That sounds weird, and I definitely wouldn't input my credentials to any popup without address bar. I also wouldn't input e.g. Microsoft SSO login info to a main site of some 3rd party.
    – jpa
    Commented 21 hours ago
  • 1
    @schroeder ah, do you mean like this? drive.google.com/file/d/1iirGqJbA5KzK6BNAUxna-WypDZM-GST2/… I think Firefox always shows a URL for popups now, for this reason. Apparently so does IE7; it's an old change: gtalbot.org/BugzillaSection/…
    – sourcejedi
    Commented 19 hours ago
  • @jpa no MS Teams desktop client for you then - or at least not trivially. The main window has no address bar, and acts as a popup that could be spoofed fairly easily when clicking on a "join meeting" link. If you want to use the desktop client for meeting links you have to remember to sign into it first.
    – Chris H
    Commented 18 hours ago
  • 2
    @jpa we've had some backend changes recently, and the login is in the main Teams window (Linux client); the issue is mainly if something else spawns Teams. But bad design from those who should know better is disturbingly common. I've had to complain to my bank recently (and got nowhere) because they send an email including both "We won't sent you a link to log in" and a link that takes you to a page with a big login button - and misleading content that makes you want to log in and check details
    – Chris H
    Commented 15 hours ago

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .