2

These days so many websites/apps (including StackExchange) allow logging in using your Facebook, GoogleId, or LinkedIn credentials. Whatever method you choose, you are presented a box to enter your credentials for that method. I think it is possible for a malicious web site/app to make a fake credential form which resembles say Google login, and phish your credentials.

Are there any safeguards to stop this from happening?

Improve this question
1
  • I think the best way to is to use your own credentials for login. Cause it's maybe easy to use your Google account everywhere but as you said it not possible to warranty that nobody is phising you. Or use plug-in like noscript to filter on the website script that can be running
    – Papa SALL
    Aug 9, 2015 at 22:22

5 Answers 5

Reset to default
2

I protect myself from look-alike phishing sites by using the Lastpass browser extension to store my passwords. Lastpass will by default only enter credentials on the correct domain, and it is much simpler for a computer to parse the domain than a human. If you are about to enter credentials into the incorrect domain, Lastpass provides a warning:

Lastpass security warning

Lastpass has many other security features as well, such as enforcing unique passwords for all websites.

Improve this answer
1

A user can detect he is probably on a phishing web server by reading the first part of the URL after the protocol header:

http://
https://

For example to connect on this web server the URL is something like:

http://security.stackexchange.com/login...

and the field to check is:

security.stackexchange.com

If in place of this web server name, which I knowingly wanted to connect to, I read something like:

http://security.stackechange.com/login...

I am pretty sure that I am on a booby trapped web server which is most probably conceived to steal my account and password or some other private information.

You may also trust some advanced browser with blacklist integrated function (like Firefox) to help you in this fight. But nothing will replace a pair of good eyes and a fight brain behind :).

Improve this answer
2
  • What is the API login is done through an iFrame? You will never get to see the real API url.
    – user83034
    Aug 10, 2015 at 14:24
  • Before opening an iframe you have to connect on a web server. This is a booby trapped one and you will have to use its URL: you have here many chances to check it. I have to admit that some changes from .gov to .com are sometimes hard to notice. Among a few hundreds of phishing I never saw one which wasn't a coarse makeup.
    – dan
    Aug 10, 2015 at 15:16
0

Unfortunately, there are little safeguards except from keeping attention:

  • Check, that the the link to the login goes to the site it claims that it comes from (i.e., verify, that the login forms go to google.com, facebook.com etc.)
  • Check that the link uses the https protocol
  • Only use your Google/Facebook/Whatever account on site you trust
  • And check that you are really visiting the site you trust (and not some other site with a similar looking name, may it be a typo or a clever spoof using some strange unicode characters)
Improve this answer
0

Only enter your credentials for the service when the domain matches the one you expect e.g. facebook.com for Facebook, Google.com for Google, etc.

Also check that the protocol is https in the address bar, and that there's a padlock symbol displayed.

It's all about the address bar. Simples.

Improve this answer
-1

There is no way to stop others from copying front-end files, so it's pretty much impossible to stop phishing. HTML, CSS, and Javascript documents in addition to other files such as images will always be available to the public. The phisher(s) will just steal whatever documents they need to re-create the front-end of the targeted website then create their own back-end code that captures data (probably logins) from POST requests.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .