back
7 comments
This isn't the "new thing to worry about" being emphasized, but:

> You chose to use a “sign in with <service>” login when you had to create an account, and it sent you through a realistic-looking login flow: a real-seeming Google/iCloud page, perhaps with your email already filled in. When you logged in to this site they used your entered password and subsequent “tap yes on your device” 2FA flow to log in to your account on their end (saving the session cookies), and made it look like a successful login on your end.

The security-hygiene rule to prevent this (which, alas, requires consistency and paranoia) is that passwords may only be entered into Google/iCloud/etc. when you directly visit the provider's site.

Once you know your browser is authenticated to the SSO provider, you reload the target page (e.g. the NDA signing platform) and expect that you will never need to enter a password again.

Yeah. I do use this trick.

Some "root" passwords are ones I do not put in my password manager out of "what if my pwd manager gets compromised" paranoia, but that makes me more vulnerable to this.

And annoyingly some websites like to forget you're logged in. Not Google as much, but it's a thing that happens enough that means that there's a chance that I would blindly enter a password if my guard was down. A slight chance I think (especially in the last year where i've been worried about more sophisticated scams) but a chance nonetheless.

The fact that your password manager wouldn't offer to fill-in the password field of the fake login page (due to the domain being unknown) should make you raise an eyebrow.
I say "hygiene" because--like handwashing after the toilet--it's something everyone can do without particular tools or expertise.

Archetypal Aunt Tillie's "password manager" will be a handwritten piece of paper, but the rule of "only log-in with this bookmark and assume other prompts are lies" will still work.

This. Depending on your policy or org’s policy, your auth session may be short lived. Going to Google to login and come back every hour is a worse experience. Use your password manager. It will bind the credentials to the domains.
The author may really like "The Sting" but the movie was a rip-off of a book by David Maurer, and all of the con mechanisms in the movie were lifted without permission from his book. The theft was later settled privately for a huge sum.
Having hustled the mean streets in my teens and twenties, my sense of "no not right" is finely tuned, though I now have a business that puts my number on the net, several times and as the only customer faceing person, I answer the fucking phone and do my best to be helpfull ,polite, every time. I now have worked out a smooth method to deflect and decline, unless it is clearly ai, and I pull the plug as they "refine" the model bit by bit and close off "loopholes", but by then it's so vauge as to be clearly struggling, so.hanging up is the only option I have time for, but they still get 12 seconds.