I think you're both right - they way I read their comment was more like "if you expect a phishing attack from certain sources, this implies you're not on the defensive against attacks which aren't from those sources".

Password managers with browser extensions are a good fix for this too. If you're used to entering your password only through the extension, not being able to do that on a login screen would be a big warning sign. Admittedly, these extensions have had some vulnerabilities in the past, but phishing is simply a bigger problem for the vast majority of users.

Obviously, for sites that support U2F (like Google), getting a YubiKey or any other U2F-compatible key would be the best protection against this.

Semi-relevant link from Bruce Schneier on the subject and that he did not design password safe with a browser extension in mind. https://www.schneier.com/blog/archives/2014/09/security_of_p.... The android version implements a keyboard replacement rather than integrate though not as easy to use is still mostly usable.

I read it as, “you should never be in the mindset of ‘expecting’ a phish from any [specific] source.”

I think OP agrees with you.

> Every time you're about to paste your password, glance at the url bar.

Actually - I disagree with this. You can no longer "glance" at the url bar to determine if you are on the right domain due to Unicode chars if you clicked a link.

The only safe way is to type the url yourself into the browser.

If it is a long link - then at least typing the base domain, and pasting the "rest" is probably safe?

I use 1Password to autofill my passwords, which it won't do if the domain doesn't match, which should also work.

This actually isn't true. A website like https://www.xn--80ak6aa92e.com/ won't show up as apple.com. Browsers don't allow Unicode rendering in the URL bar.

Maybe IE is affected though. I haven't tested every browser. But it's a known security concern.

It shows up as www.apple.com on Firefox 54.0.1 (latest, up-to-date) on OSX.

Just tried - same (54.0.1) FF version on Android DOES show apple.com (Chrome and Yandex do not).

about:config, set network.standard-url.punycode-host to true

Disable IDN and you will be safe from those. If you're not going to use non-ASCII domain names, you won't miss much.

Sorry to tell you, does show up as apple.com in my browser. Chrome 52.0.2743.82-1 on Arch x86_64.

That version of Chrome is over a year old.

The IDN vulnerability was fixed by Google in Chrome 58.

https://arstechnica.co.uk/information-technology/2017/04/chr... https://bugs.chromium.org/p/chromium/issues/detail?id=683314

Why have you got such an old version of Chrome?

Thank you. That gives me a strong reason to update.

To answer your question, (1) it's pretty arduous to install Chrome from the AUR, and (2) I am wary of Google removing useful functionality from Chrome.