Hacker News Reader

Comment by jacobsenscott | Hacker News Reader

A password manager helps simply because it "remembers" exactly what sites you've been to in the past and if you go to a different site with a same looking url it won't auto-fill.

Well, your browser also has a history of all the sites you've been to in the past, and people tend not to go to a lot of random sites. It would be pretty simple to display something when you go to a site you've never been to before. Just an unobtrusive, but not too unobtrusive, "this is your first visit to this site.". So when you see that on googie.com you might double check where you are. If the site url is similar to one you've been to in the past it could even say "Did you mean to go to one of these sites with similar looking names?...."

I'm not sure what the deal is with shilling for a vpn, or how that helps. It doesn't.

View on HN

> Well, your browser also has a history of all the sites you've been to in the past, and people tend not to go to a lot of random sites. It would be pretty simple to display something when you go to a site you've never been to before. Just an unobtrusive, but not too unobtrusive, "this is your first visit to this site.".

Whoa, that seems like a shockingly good idea! It could look similar to what happens when you enter data into a password field on a non-https website. The browser can pop up a little box under the input when you start typing, which says something like "this is your first time visiting this website. Only enter passwords on websites you trust."

Are there any major downsides I'm missing? Signing up for accounts on new sites would certainly create false-positives, but if the warning is properly coded that doesn't seem like such a problem.

Several people are suggesting this on this post, but it won't work for input. The phishers will just stop using password forms. And if you make it for all forms, well that can probably be faked trivially with javascript.

It _would_ work for first time visits, but I propose that it will be too common that people will ignore it or brainlessly click through it, providing little to no security benefit.

Phishing is an artifact of the bad design of the system of remembering a password, and will likely continue until we design and widely deploy a better alternative.

You could trigger on any keypress on a first-time site.

Hopefully being careful with TAB or anything else somebody might be using for navigation. God help you if you use vimium in that world.

Hell, that warning could be helpful even on signups to new sites: “This is your first time visiting this website. Only enter passwords on websites you trust, and don’t reuse passwords from other sites. We recommend you use this securely-generated password:”

Idk, I’d get a little nervous extending it too much. Browsers and sites have far too many use-our-new-feature-plz popups. This shouldn’t look like that, or it’s more likely to be ignored.

I might keep your first addition but nix the final paragraph, as good a suggestion as it may be.

To be fair, my browser (Firefox) already suggests a secure random password on password dialogs for sign-ups; I believe they are either using the heuristic of "no password saved on the site" or "password confirmation box exists". I was more-or-less simply thinking of extending that particular message.

Finally a way to know if you should try to reset your password before creating a new account. It sometimes happens that I don't remember I've already signed up for some site and forgot about it entirely.

Reply on news.ycombinator.com