Google-hosted malvertising leads to fake Keepass site that looks genuine

1

KeePassXC

When you're at a point where you're relying on a display name to make security-critical decisions, you've already lost. Character substitutions like ķeepass or ƙeepass or keypass are at least possible to spot if you know the name of the product, but not the full URL. But there are many ways to create lookalike domains that don't change the product name: https://keepass.org https://keepass.net https://keepass.info https://keepass.cx https://keepassxc.org https://keepass-info.net https://keepass-manager.com Which of these is the correct one? (It's https://keepassxc.org of course, but just looking at the URL won't tell you that.) The root cause is downloading software you see advertised on Google even though that does not in any way establish trustworthiness.

#Password Management #Password Managers #Security & Privacy 232 social mentions

2

KeePass

When you're at a point where you're relying on a display name to make security-critical decisions, you've already lost. Character substitutions like ķeepass or ƙeepass or keypass are at least possible to spot if you know the name of the product, but not the full URL. But there are many ways to create lookalike domains that don't change the product name: https://keepass.org https://keepass.net https://keepass.info https://keepass.cx https://keepassxc.org https://keepass-info.net https://keepass-manager.com Which of these is the correct one? (It's https://keepassxc.org of course, but just looking at the URL won't tell you that.) The root cause is downloading software you see advertised on Google even though that does not in any way establish trustworthiness.

#Security & Privacy #Password Management #Password Managers 206 social mentions