Slashdot Mirror
Google Announces "Password Alert" To Protect Against Phishing Attacks
HughPickens.com writes: Google has announced Password Alert, a free, open-source Chrome extension that protects your Google Accounts from phishing attacks. Once you've installed it, Password Alert will show a warning if you type your Google password into a site that isn't a Google sign-in page. This protects you from phishing attacks and also encourages you to use different passwords for different sites, a security best practice. Once you've installed and initialized Password Alert, Chrome will remember a "scrambled" version of your Google Account password. It only remembers this information for security purposes and doesn't share it with anyone. If you type your password into a site that isn't a Google sign-in page, an alert will tell you that you're at risk of being phished so you can update your password and protect yourself.
Why would you update your password because of a *failed* phishing attempt?
Google warning us about other people trying to get our informations.
Get free satoshi (Bitcoin) and Dogecoins
Allen Ludden...what a retro trip...how quaint.
It's sad how far Slashdot has fallen.
Why bother scrambling when we already know that chrome puts saved passwords in a clear text unencrypted text file?
Put on the popcorn and wait for the fireworks show that arises when people who use the same password they use for google on other sites.
Still its an interesting idea, that might be usable in a general purpose extension that maintains hashes and URLs and then hashes every input box and compares it to the databse / urls -- and if it finds a hash match but the URL is wrong throw up an alert.
Way more useful than a google only one that only works in chrome and only when you are signed in.
They should just bundle this into their browser.. seriously.
Can you please stop with this plebs speak? This is a site for nerds, not for non-technical people. Say "hash" when you mean "hash". I mean is researching actual technical info so hard? For everyone not wanting to click links: its comparing the first 37 bits of the hash, using the SHA-1 hash mechanism. And yes its salted.
So like the cops... it shows up only after the crime has been committed, and only protects some of the population (Google passwords) and not the rest of the population (e.g. your banking password isn't protected, because it's not a Google site).
Seems slightly less than useful.
https://xkcd.com/792/
Seems to me that if you use a password manager - LastPass among others - then this is unnecessary. I never type my password. and if I'm phished, then the site won't match the password manager entry and won't be filled in. So, google would have been better off allowing / providing a good password manager rather than this half measure that only sees it after the fact rather than preventing you from entering it in the first place. Personally, I'm waiting for SQRL that will eliminate the need for passwords altogether. https://www.grc.com/sqrl/sqrl.... -ww
If you type your Google password into some other website with this feature enabled, it automatically turns it into asterisks like this: *******
If I have been able to see further than others, it is because I bought a pair of binoculars.
Ignore the fact that a Google Apps domain can use their own SAML SSO solution to effectively replace the Google signin page. This means that their new anti-phishing plugin would be rendered useless. Additionaly if this is used on a domain, it also bypasses their two-factor authentication mechanism (even if you set it up).
Now if I get a foothold on your machine, I can run a hidden browser window pointed at my own server and start feeding random passwords into a form until the browser alert tells me I guessed correctly.
Users who are savvy enough to find and install this extension are less likely to fall for phishing.
Users who may fall for phishing may not hear about the extension or do not know how to install it.
Why not build it in the browser itself?
It's Rube Goldbergs all the way down!
First, you download random Javascript off the 'net, hope for the best and *execute that crap on your machine*. Voluntarily.
Then you have some other built-in, more complex piece of code that tries to tipp you off that this random Javascript is trying to do something nasty.
Then there is this other randomly downloaded Javascript that thinks that you are trying to free-ride the valuable service of this website by looking away when the ads pop up.
Then...
what could possibly go wrong?
(still pissed off at Mozilla because they took away the simple "disable Javascript" checkbox with some weak pretext sounding like "our users are idiots" or something).
So now people will have passwords like this:
google_password
tinder_password
linkedin_password
facebook_password
instead of just "password"
I think at this point using a Google Authenticator generated code _as_ the password should be enough. It removes the user from the process of creating a "correct horse battery staple" password. It makes the authentication pretty much on par with SSH key authentication (you have a private key, Google has the public part, you generate a code that demonstrated that you have the correct key). I'd like to see phishing sites ask you for your private key, as see how many morons are out there who would actually jump through the hoops of obtaining that key from their phones and pasting it to the phisher, 'cause hey, "a million Nigerian dollars is a lot of money".
Question for religious people: where do unrepentant masochists go when they die?
Google is on to something, but the implementation is wrong. First of all, this facility should be built in to browsers, not added as an extension. Secondly, it needs to be generalized: Just as browsers currently ask "Would you like to save this username/password for www.somesite.example", they should also ask "Would you like to lock this username/password combination to www.somesite.example?" and offer the usual "Yes / No / Not now" choices.
If you say "Yes", then the browser should alert you every time it sees that password on a different site.
Sounds like Google wants you to install a keylogger for your safety.
Popisms.com - Connecting pop culture
Suppose I visit another site that offers to let me "sign in with" my Google account. Will this extension check for a man-in-the-middle attack? I.e., confirm that my password is really going to Google and will not be exposed to the site I'm visiting? Or is the whole "sign in with" process hopelessly insecure?
Additionally, every slashdaughter who knows what hashing is realized that's what they meant by "scrambled".
"Scrambled" can also mean reversibly encrypted, as in the Content Scrambling System used with DVD Video.
If you "sign in with your Google account" on some website, you're using OpenID Connect. This takes you to a Google page, you give your password to Google, and then Google sends an OAuth 2 token representing your account back to the relying party and redirects you to the relying party's website. The relying party never sees your Google password.
because they didn't want to bundle a password manager when you can add one as a plugin?
They bundled one, an insecure one. It provides a false sense of security in the same sense that a self-signed HTTPS certificate provides a false sense of security.
If I start typing my password the site can collect it as I type. By the time I'm done it is too late.