What does the closed padlock icon that occasionally appears next to a website name mean? For many users, it means security and authenticity.It is often recommended to verify that this is present before entering a password or personal data, and some browsers, such as Google Chrome, show the word 'Safe' next to this symbol. Related
However, this mechanism can be a bit tricky and create a false sense of trust, which opens the door to possible scams .In fact, the lock does not guarantee that the web is authentic: only indicates that the data we enter on it is transmitted in an encrypted way and, therefore, is very difficult to intercept.But it says nothing about the identity and reliability of the web.
This means that scammers can "draw" a landing page that visually imitates the graphic appearance of a famous website (Facebook, Google, PayPal, that of a bank or a store) and then send the victim an email or a message through Facebook or WhatsApp to invite her to visit the fraudulent site, have her enter her password and then steal it.All this with the false security impression, that we derives from the vision of the closed padlock and the word 'safe'.
The rise of false security locks
The victim will be saved from this trap (called phishing ) only if he realizes that the name of the web is not the correct, but there are few who verify the name of each website they visit.Generally, we limit ourselves to the visual aspect or the presence of the padlock, especially from the small screens of mobile phones.
According to data recently published by the security company PhishLabs, today a quarter of the trap websites created by scammers to steal passwords show a lock closed .An extraordinary increase, since, just a year ago, fraudulent pages with this characteristic were less than three percent.
This boom means that password stealers have realized that users lower their defenses when they see the closed padlock and therefore have organized accordingly.It is no longer enough to search the closed padlock, we must also verify that the name of the website is correct , although it is easy to get confused.For example, on the bank or ecommerce page that we use more frequently, is the name written with or without script?
How to create a fake website
Today, anyone can obtain a digital security certificate, which activates the display of the padlock, even for free.The computer security researcher James Burton has found an ingenious way to make a fake website even more credible , and it is better to know to avoid being cheated.
Burton opened a company in the UK (where it is very simple and cheap to do so) and call it Identity Verified .Then he turned to Symantec, a software manufacturer of information security , to prepare a digital security certificate for companies in the name of Identity Verified , associated with your personal website with a free trial period of thirty days.Finally, I believe in your homepage a copy of the Google and PayPal login pages.
Result: a victim who visits the web with her iPhone and Safari (because she has given a link present in an email that pretends to be a Google or Paypal alert) meets what is expected, that is, the page that appears to enter the passwords of Google or PayPal.At the top you can see, instead of the name of the site (which could reveal the dwarf), the reassuring words Identity Verified .Words that seem authenticate the page, but they are simply the name of the company.
In fact, Apple's browser, Safari , when it finds a website encrypted by a digital security certificate, shows the name present in the certificate, instead of the real name of the web .Go a little better, but not much, with other browsers, such as Google Chrome, which shows the name of the web but flanked by a comforting green padlock with the words Identity Verified .
Moral of the story: you should not trust what you see in the browser after giving a link received in an alert message.Better yet, it is not advisable to click on this type of link, but visit manually the web mentioned, writing the address or using the bookmark link.Not everything that fails in the world is the fault of the mythological 'Russian hackers', being necessary to take some precautions.
Comments
Post a Comment