Simon Willison’s Weblog

[Passkeys are] something truly unique, because baked into their design is the requirement that they be unphishable. And the only way you can have something that’s completely resistant to phishing is to make it impossible for a person to provide that data to someone else (via copying and pasting, uploading, etc.). That you can’t export a passkey in a way that another tool or system can import and use it is a feature, not a bug or design flaw. And it’s a critical feature, if we’re going to put an end to security threats associated with phishing and data breaches.

— Adam Newbold

# 15th August 2024, 12:25 am / passwords, phishing, security, passkeys

The username/password key's major disadvantage is that it open all the doors to the house. The OAuth key only opens a couple doors; the scope of the credentials is limited. That's a benefit, to be sure, but in Twitter's case, a malicious application that registered for OAuth with both read and write privileges can do most evil things a user might be worried about.

— Alex Payne

# 5th January 2009, 10:47 am / alex-payne, oauth, phishing, security, twitter

OAuth came out of my worry that if the Twitter API became popular, we'd be spreading passwords all around the web. OAuth took longer to finish than it took for the Twitter API to become popular, and as a result many Twitter users' passwords are scattered pretty carelessly around the web. This is a terrible situation, and one we as responsible web developers should work to prevent.

— Blaine Cook

# 14th August 2008, 10:01 am / blaine-cook, oauth, passwords, phishing, security, twitter, twitterapi

The statement that the password anti-pattern "teaches users to be phished" should be rephrased "has taught users to be phished"

— Me, on Twitter

# 13th August 2008, 12:52 pm / passwordantipattern, phishing, security, twitter

A typical phishing email will have a generic greeting, such as 'Dear User'. Note: All PayPal emails will greet you by your first and last name.

— PayPal's Phishing Guide

# 22nd September 2007, 2:33 pm / doh, email, paypal, phishing, security

We have a unique opportunity with phishing and OpenID. OpenID can make the possibility for bad things to happen from phishing that much worse. However, having an OpenID means you create a more intimate relationship with your OpenID provider. You go there everyday. You will more likely know when something is wrong.

— Scott Kveton

# 24th January 2007, 3:02 pm / openid, phishing, scott-kveton

I can also sum things up for you even more succinctly:

• users are task oriented, driving to complete the goal the
  quickest way possible
• users pay more attention to the content area than the browser chrome
• users don't understand how easy it is to spoof a website

— Mike Beltzner

# 19th January 2007, 5:33 pm / openid, phishing

Why don't we have a .bank or .bank.country_code TLD that's regulated by the same people that regulate the banks themselves?

— Dean Wilson

# 7th January 2007, 10:22 pm / dean-wilson, phishing, security