Gitlab phished its own work-from-home staff, and 1 in 5 fell for it

Re:Gitlab phished its own work-from-home staff, and 1 in 5 f... by novok on Saturday May 23, 2020 @02:01PM (#23284990)

Autofill matching breaks in many ways on the same website, so you have to keep on doing it manually. Ex: Chase has about 5 different ways / pages you can enter your login credentials.

[ Parent | on HN ]

Re:Gitlab phished its own work-from-home staff, and 1 in 5 f... by ripdog on Saturday May 23, 2020 @02:23PM (#23285161)

That sounds awful, but all you need to do is add all the legitimate domains to your chase login record, then you are phish-proof.

Obviously autofill itself can break on complex page layouts, and that's fine. The security comes from the password manager doing domain matching and offering to fill the password when you click on its addon menu.

[ Parent | on HN ]

Re:Gitlab phished its own work-from-home staff, and 1 in 5 f... by cerberusss on Sunday May 24, 2020 @08:49AM (#23291134)

> Chase has about 5 different ways / pages you can enter your login credentials

If they had 5 different ways, that'd be one thing. Lately, I've been seeing different domains. For example the marketing department registers a domain such as AcmeExclusives.com.

[ Parent | on HN ]

Re:Gitlab phished its own work-from-home staff, and 1 in 5 f... by ProZsolt on Saturday May 23, 2020 @07:08PM (#23287435)

That's the breading ground of phishing. If they have 5 login page a sixth won't raise any red flags.

[ Parent | on HN ]