This. The only way to check is to verify the certificate, which on Chrome means clicking the padlock, switching to the Connection tab, and then viewing certificate information. Not exactly straight forward.
back
2 comments
The only way to check is to verify the certificate,
Or use a U2F key as a second factor. Avoiding MITM fishing attacks is one its explicit design goals. In short: the MITM does not have the right key handle, so it cannot initiate the challenge-response.
https://developers.yubico.com/U2F/Protocol_details/Overview.... https://developers.yubico.com/U2F/Protocol_details/Key_gener... https://developers.yubico.com/U2F/Protocol_details/fido-u2f-...
U2F is supported by Google and Dropbox (since one or two weeks). Keys cost ~10-15 Euro a pop. Buy two keys, keep one with you, put the other in a fire-proof safe.
If you already trust your CA authorities and you already know what domain to expect, then that's not necessary, you only need to check for HTTPS and the domain name.
Checking the domain name isn't sufficient because some letters look similar to each other and not all users are capable of doing precise string comparison matching in the same way that programmers do. The article has an example - qoogle.com instead of google.com. I bet that a significant number of users would miss this when asked to check.
How does it differ from checking the domain name in the certificate? I don't get it.
It doesn't differ from checking the domain name in the certificate. It does differ from checking the entity in the EV certificate, which is generally the legal name of the company.
In theory, a phisher could register a company with a similar name to the target website's legal name, obtain a valid EV certificate for that, and then phish using a similar looking domain with a similar looking EV certificate legal name. In practice, if that were to begin happening, I'd like to think that the authorities in charge of legal entity registration (eg. Companies House in the UK) would start requiring identity checks for the legal entity registrations, and then phishers would not have an easy path to exploit this route.
The discussion started with only mentioning DV certificates.
> I'd like to think that the authorities in charge of legal entity registration (eg. Companies House in the UK) would start requiring identity checks for the legal entity registrations
Wait, they don't require that now?