New attacks article: phishing #41115

wbamberg · 2025-09-12T21:19:33Z

Here's a new article on phishing attacks.

I went back and forth a bit on how much to talk about the details of WebAuth. Minimally we could just say "a passkey is associated with an origin, and the browser will never allow the user to choose the passkey for the real site when the user is on the fake site". But it felt worth talking a bit more than this.
I'm not sure how much to talk about "downsides" of passkeys. I do feel like the tooling isn't so mature at the moment and things like passkey export are a bit unclear. But I don't know much about this (yet).
I was also on the fence about including the bit on security indicators. In the end I have included it but not recommended it.

github-actions · 2025-09-12T21:20:19Z

files/en-us/web/security/attacks/phishing/index.md

+6. The user's authenticator app generates the same TOTP, and the user enters it on the fake site.
+7. The fake site relays the TOTP to the real site, and the attacker is given access.
+
+![](TOTP-phish.svg)


[markdownlint] _{reported by reviewdog 🐶}
MD045/no-alt-text Images should have alternate text (alt text)

Josh-Cena · 2025-09-12T22:08:53Z

Another defense I've seen websites do, is ask the user to enter a custom phrase that is displayed on the login page. That way, unless the phishing site knows the custom phrase (which is as bad and as hard as knowing the actual credentials), the user will be alerted that it's not the real site. This is perhaps significantly easier to implement than OTP and passkeys.

github-actions · 2025-09-15T16:19:07Z

Preview URLs

Flaws (3)

Note! 2 documents with no flaws that don't need to be listed. 🎉

URL: /en-US/docs/Web/Security/Attacks/Phishing
Title: Phishing
Flaw count: 3

macros:
- Can't resolve /en-US/docs/Glossary/multi-factor_authentication
unknown:
- Error serializing baseline for numeric-seperators: missing field description``
- Error serializing baseline for single-color-gradients: missing field description``

External URLs (4)

URL: /en-US/docs/Web/Security/Attacks/Phishing
Title: Phishing

https://hidde.blog/making-password-managers-play-ball-with-your-login-form/ (1 time) (Note! This may be a new URL 👀)
https://www.cloudflare.com/en-ca/learning/dns/dns-records/dns-dkim-record/ (1 time) (Note! This may be a new URL 👀)
https://www.cloudflare.com/en-ca/learning/dns/dns-records/dns-dmarc-record/ (1 time) (Note! This may be a new URL 👀)
https://www.cloudflare.com/en-ca/learning/dns/dns-records/dns-spf-record/ (1 time) (Note! This may be a new URL 👀)

(comment last updated: 2025-09-17 22:42:25)

wbamberg · 2025-09-15T18:36:43Z

Another defense I've seen websites do, is ask the user to enter a custom phrase that is displayed on the login page. That way, unless the phishing site knows the custom phrase (which is as bad and as hard as knowing the actual credentials), the user will be alerted that it's not the real site. This is perhaps significantly easier to implement than OTP and passkeys.

I do remember some sites that used to do this a long time ago. Is it still current practice? Do you know any significant sites that still do this (e.g. banking sites)? I think it would still be vulnerable to the adversary in the middle attack, and I wonder how well defenses based on users paying attention work against attacks that are really all about users who are not paying attention...

Josh-Cena · 2025-09-15T19:31:57Z

I have a banking site that does this, but everything else about the site is old enough so I'm not sure if it's in trend in general. Nevertheless I think it's a viable practice to recommend, especially for low-capability developers or needing to support extremely esoteric setup.

vulnerable to the adversary in the middle attack

Isn't that solved by HTTPS?

users paying attention work against attacks that are really all about users who are not paying attention

Yeah that's true. It has to be baked into the UI and the user has to be accustomed to seeing it. Anyway the site looks like this:

* upstream/main: (32 commits) FF143 GPU import external texture experimental relnote (mdn#41126) added ff release note for nested pseudo-elements (mdn#41146) Add a page for SSRF attacks (mdn#41105) New CSSOM view API landing page, move CSS guides under (mdn#40547) 40778 color input value (mdn#41086) Synchronize with BCD v7.1.5 (mdn#41116) Cross-reference `:target` and `::target-text` pages (mdn#41121) Fix content issues (mdn#41125) Make all JSON code syntactically valid (mdn#41120) Fix the link name with actual heading (mdn#41117) Associated listed form controls (mdn#41096) Mention `new Set()` accepts `undefined` (mdn#41106) chore: correct the `timeRange` function name (mdn#41107) Mention that custom elements constructors can't be directly called (mdn#41069) chore(deps): bump @mdn/fred from 1.3.2 to 1.4.0 (mdn#41111) Public-key cryptography glossary page: add headings and links (mdn#41092) Improve caret color demo contrast (mdn#41104) Fix supported algorithms for HKDF and PBKDF2 (mdn#41100) Update MongoDB example to async/await (driver v5+) (mdn#41102) Remove onload and DOMContentLoaded handlers (mdn#41079) ...

files/en-us/web/security/attacks/phishing/index.md

Elchi3 · 2025-09-17T13:06:59Z

files/en-us/web/security/attacks/phishing/index.md

+
+Phishing is a very old but still very common attack, which has gone through many variations, both to evade defenses and to take advantage of new vulnerabilities. In a basic form, though:
+
+1. The attacker registers a domain name that resembles the target site. For example, if the user's banking website is `my-bank.example.com`, the attacker could register `my-bank.examp1e.com`.


Optional: I think it might be worth calling out some tricks specifically. For example, say that unicode tricks (e.g. cyrillic ‘а’ vs Latin ‘a’) might get used and that the fake site might still use HTTPS and the original site's favicon to make the fake appear legitimate.

There's also semantic attack (which was briefly mentioned in https://developer.mozilla.org/en-US/docs/Web/URI/Reference/Authority, although I just realized the Wikipedia link on that page is talking about a slightly different thing).

We could add this, but I'm not sure it's that important in this guide to go into specific things attackers can do to make the fake domain resemble the target. None of this is actionable for developers AFAIK.

Elchi3

This looks great to me, Will!

Given many phishing attacks come via email I wondered what to do and I think this Cloudflare article has some good advice: https://www.cloudflare.com/learning/email-security/how-to-prevent-phishing/ From that we could maybe say that properly configuring SPF, DKIM, or DMARC email checks would be a thing that developers / domain owners should do? (among other things)

Co-authored-by: Florian Scholz <[email protected]>

wbamberg · 2025-09-17T22:41:35Z

This looks great to me, Will!

Given many phishing attacks come via email I wondered what to do and I think this Cloudflare article has some good advice: https://www.cloudflare.com/learning/email-security/how-to-prevent-phishing/ From that we could maybe say that properly configuring SPF, DKIM, or DMARC email checks would be a thing that developers / domain owners should do? (among other things)

I have added a bit on this although I'm not sure how well I understand it!

Draft phishing article

e57d9fc

github-actions bot added Content:Security Security docs size/m [PR only] 51-500 LoC changed labels Sep 12, 2025

github-actions bot reviewed Sep 12, 2025

View reviewed changes

wbamberg added 2 commits September 12, 2025 14:22

alt text

04c6b62

lowercase filename

9918965

Rename SVG

1c2181a

wbamberg added 4 commits September 15, 2025 14:56

Updates to passkey section

7150c1d

More updates to passkey section

fd7a52c

typoes

5e742ef

github-actions bot added the Content:Glossary Glossary entries label Sep 15, 2025

wbamberg added 6 commits September 15, 2025 15:39

drafting se glossary page

708e772

more typoes

889c2ba

more typoes

1370849

se glossary page

a467cf0

Add a section on security indicators

fabbbb0

Add entry in Attacks page

7573022

wbamberg marked this pull request as ready for review September 16, 2025 17:44

wbamberg requested a review from a team as a code owner September 16, 2025 17:44

wbamberg requested review from dipikabh and Elchi3 and removed request for a team and dipikabh September 16, 2025 17:44

Elchi3 reviewed Sep 17, 2025

View reviewed changes

files/en-us/web/security/attacks/phishing/index.md Outdated Show resolved Hide resolved

Elchi3 reviewed Sep 17, 2025

View reviewed changes

Elchi3 approved these changes Sep 17, 2025

View reviewed changes

wbamberg and others added 2 commits September 17, 2025 08:36

Update files/en-us/web/security/attacks/phishing/index.md

87fd3d4

Co-authored-by: Florian Scholz <[email protected]>

Add a bit on DNS records

2e50854

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

New attacks article: phishing #41115

New attacks article: phishing #41115

Uh oh!

wbamberg commented Sep 12, 2025 •

edited

Loading

Uh oh!

github-actions bot Sep 12, 2025

Uh oh!

Josh-Cena commented Sep 12, 2025

Uh oh!

github-actions bot commented Sep 15, 2025 •

edited

Loading

Uh oh!

wbamberg commented Sep 15, 2025

Uh oh!

Josh-Cena commented Sep 15, 2025

Uh oh!

Uh oh!

Elchi3 Sep 17, 2025

Uh oh!

Josh-Cena Sep 17, 2025

Uh oh!

wbamberg Sep 17, 2025

Uh oh!

Elchi3 left a comment

Uh oh!

wbamberg commented Sep 17, 2025

Uh oh!

Uh oh!


		Phishing is a very old but still very common attack, which has gone through many variations, both to evade defenses and to take advantage of new vulnerabilities. In a basic form, though:

		1. The attacker registers a domain name that resembles the target site. For example, if the user's banking website is `my-bank.example.com`, the attacker could register `my-bank.examp1e.com`.

New attacks article: phishing #41115

Are you sure you want to change the base?

New attacks article: phishing #41115

Uh oh!

Conversation

wbamberg commented Sep 12, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot Sep 12, 2025

Choose a reason for hiding this comment

Uh oh!

Josh-Cena commented Sep 12, 2025

Uh oh!

github-actions bot commented Sep 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

wbamberg commented Sep 15, 2025

Uh oh!

Josh-Cena commented Sep 15, 2025

Uh oh!

Uh oh!

Elchi3 Sep 17, 2025

Choose a reason for hiding this comment

Uh oh!

Josh-Cena Sep 17, 2025

Choose a reason for hiding this comment

Uh oh!

wbamberg Sep 17, 2025

Choose a reason for hiding this comment

Uh oh!

Elchi3 left a comment

Choose a reason for hiding this comment

Uh oh!

wbamberg commented Sep 17, 2025

Uh oh!

Uh oh!

wbamberg commented Sep 12, 2025 •

edited

Loading

github-actions bot commented Sep 15, 2025 •

edited

Loading