10 Feb
2012
10 Feb
'12
2:16 p.m.
On Fri, Feb 10, 2012 at 12:28:22PM -0500, Steven Bellovin wrote:
If they're intended as a path to log in with a typed password, that's correct. Sad, but correct.
I agree. Training your customers/clients to click on URLs in email messages is precisely equivalent to training them to be phish victims. I teach people to (carefully!) bookmark the sites that they use which require passwords, and to always use those bookmarks -- that is, *never* to use the links in any mail message or on any web page. (Of course, an attacker in control of their browser could manipulate the bookmarks, but there is little reason for an attacker who's already gotten that far to do so.) ---rsk