5

A website prompts me to log in to my Microsoft Account. In order to perform my task, it requires me to enter that password.

How does the "average user" avoid giving all their login details to a malicious website?


For example, I came across someone's personal website. I wish to download some music, but...

Can't download multiple files simultaneously despite following OneDrive's documentation

The first step of the instructions says: "on your OneDrive".

To download multiple files, you must be logged in to OneDrive with your Microsoft account.

3 Answers 3

3

I used to write training material for this exact problem, as one of our clients had very poor email security, and our most effective material were posters posted in high-trafic areas that trained users to recognize the domain name of the page asking for a password.

Modern browsers highlight the domain part of the URL specifically for this purpose:

a browser's URL bar

We instructed users to specifically check that the darker text was a website they were definitely 100% sure was tied to the service they were attempting to log into.

To put a grain of salt on this, this was after several years of abysmal security practices, where users would recieve emails from unknown adresses, click the .html attachment that mimicked the microsoft login page and stole the credentials. After several instances of "I hear clarice from accounting got hacked!", users were understandably more cooperative in being sure they wouldn't be the next person to be hacked than your average user.

Modern login systems (such as 2FA, passkeys and centralized auth poviders like okta) provide additional (not complete!) security that foils the basic attacks that generally take place with phishing.

The solution provided by SourceJedi is somewhat valid, unfortunately Microsoft in their infinite wisdom are apparently unable to create a login system that correctly remembers your previous login, on top of registering domains that sound exactly like what a phisher thinks might work.

New contributor
Themoonisacheese is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
1
  • The the OP asking about the legitimacy of the main site or the window popping up for the creds for the MS/Google/Facebook account for SSO? there isn;t often an address bar on those.
    – schroeder
    Commented 2 mins ago
1
  1. Passkeys can solve this. A passkey can only be used on the website you created it for. When logging in on a PC, you can also use a passkey stored on your phone.[1]

  2. Password managers are also available from your existing web browser (or OS). A password manager will only auto-fill a password on the website you saved it for, or on a website which it knows to be equivalent.[2] This is why secure auto-fill is useful.

It is not always possible to log in using auto-fill. For example, a user might be switching to a new device, after using a very popular device which does not support exporting passwords.[3][4]

The simplest alternative to explain is (sadly):

  1. Search for the name of the service, e.g. Microsoft OneDrive.
  2. Try to avoid tapping a deceptive advert at the top of the results.
  3. Hope that the web search result shows you the real website, and use that to enter your credentials.
  4. For future use, you can accept the browser's offer to save the entered password (or create a passkey).
  5. Re-load the original web page. It should now show you as logged in. Alternatively, it might still show a log in button, but this should now let you log in without entering a password or other credentials.
  6. Now complete your task :-).

This should be safer than accepting the original sign-in request.

For important accounts, it would be great if people could save trusted bookmarks on first use. And/or double-check it is real e.g. using a second search engine, and confirming the website is already bookmarked.

(Attacks are also reduced because the main web browsers block known malicious sites. This might have improved over time, but it will never be perfect.[5])

3
  • 3
    So ... Make sure you're logged into that account first.
    – schroeder
    Commented 14 hours ago
  • 1
    Why involve a search engine at all, and risk all the potential attacks through malicious ads and accidental misclicks? Browsers still have address bars, don't they, so you just use that and replace steps 1-3 by typing google.com or microsoft.com or whatever into the address bar and logging in there.
    – TooTea
    Commented 51 mins ago
  • I was thinking en.wikipedia.org/wiki/Typosquatting . I guess you're right that's a smaller risk, partly because typosquatters of these very popular services will get blocklisted very quickly.
    – sourcejedi
    Commented 26 mins ago
1

Check the browser address bar carefully

Example address bar for live.com login

Browsers nowadays highlight the main domain in the address, and attempt to ensure there are no tricks with e.g. lookalike characters from foreign symbols.

This takes a bit of learning to recognize the domains that are genuine, as for example Microsoft uses the not necessarily obvious "live.com" as the domain for their login system.

For the average user who just wants to get things done, the biggest risk is that when things do not work, they'll discard security advice. This approach is commonly used in phishing, by creating stress for the user and then presenting a login form that just doesn't care whether you are already logged into live.com in another tab. Having a wrong domain in the login form could at least give some clue to it being a scam, even though that is also easy to ignore when you are in a hurry.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .