Microsoft Confirms Password Deletion for 1B Users

Re:Microsoft Confirms Password Deletion for 1B Users by nailer on Tuesday December 17, 2024 @03:02PM (#42444728)

>what's stopping someone from making a version of the same scheme that redirects to a prompt on the real site which authorizes them as a new user

I can give a better answer than the sibling:

The passkey is domain bound, so the UI won't show up on the phishing site before the passthrough can even happen.

Password managers are also domain-bound though.

[ Parent | on HN ]

Re:Microsoft Confirms Password Deletion for 1B Users by Terretta on Wednesday December 18, 2024 @10:41AM (#42451339)

> Password managers are also domain-bound though.

are also --> can be

Often they allow picking an entry for arbitrary domain names, made necessary by firms (such as Microsoft) randomizing their login domains to look like phishing domains.*

* Not what they are doing, but to the casual user, logging into xbox.com, office.com, or even microsoft.com through something like microsoftonline.com may as well be phishing.

[ Parent | on HN ]

Re:Microsoft Confirms Password Deletion for 1B Users by nailer on Wednesday December 18, 2024 @07:14PM (#42456955)

Agreed. Even a few hours ago I got something for w-m.com (!) which was actually genuinely sent by Walmart.

[ Parent | on HN ]

Re:Microsoft Confirms Password Deletion for 1B Users by Cpoll on Thursday December 19, 2024 @02:23PM (#42464827)

I wouldn't assume a 3-character .com is a phishing domain, they're hardly cheap and disposable. But I get your point, I've seen some suspicious (legitimate) alternate domains. Stuff like (not a real example) amazon-fulfillment.com.

[ Parent | on HN ]

Re:Microsoft Confirms Password Deletion for 1B Users by nailer on Thursday December 19, 2024 @03:44PM (#42465536)

A dash in a domain though is pretty ratchet.

[ Parent | on HN ]