Re:Half of All Phishing Sites Now Have the Padlock
by RcouF1uZ4gsC on Wednesday November 28, 2018 @02:17PM
(#18554678)
Another thing is the login with Google/Facebook buttons that do a redirect where you enter your password. It always makes me nervous that a website could create a fake Google/Facebook login page and collect my password, and I make a point of looking at the login page extra carefully. However, I bet that the average computer user doesn't do this.
[ Parent
| on HN ]
Re:Half of All Phishing Sites Now Have the Padlock
by gwright on Wednesday November 28, 2018 @10:08PM
(#18557714)
Sounds like you are talking about the OAuth authentication flow which is designed to use a separate window/iframe for entering credentials. This allows the application to authenticate the user without ever having access to the cleartext credentials.
Re:Half of All Phishing Sites Now Have the Padlock
by crgwbr on Wednesday November 28, 2018 @11:24PM
(#18558097)
That’s providing that the login page you enter your credentials in actually is Google/Facebook. The app can easily open a login page which looks identical, but actually submits your credentials somewhere nefarious.