alt Hacker NewsMy friend ended up having the URL to a fraudulent version of her online banking start getting auto-completed by her phone’s browser because they’d gotten her to click on some random SMS links a few times.
Website looked identical to the real one so they managed to easily get her one-time-codes. “For security purposes please enter the one-time-code we just sent you.”
No DNS injection. Just auto-complete and a reasonable URL and a convincing <title> in the HTML !
Replies
kakacik • today at 3:59 PM
Well, doing ebanking on phone browser sounds like a bad idea to start with. (artificial) limitations of those browsers are only some of the reasons.
➕ show 1 reply
For some reason, getting rid of autocomplete suggestions is harder than getting rid of all other browser data combined. I really don't know why. I've been wishing to clear autocomplete orders of magnitude more often than to clear history or cookies.