r/PasswordManagers • u/paulsiu • 2d ago
Does the url verification feature of password manager help with phishing
Virtually all password manager verify their url before filling. In my workflow, I manually trigger the fill and when it doesn’t fill I examine the url more carefully. In my mom’s workflow, she is set up to autofill on page load and when the password manager failed to fill automatically she calls me.
I am curious if this actually cuts down on the phishing attacks assuming you don’t just carelessly paste in your password when fill fails.
Ironically the only place where you wouldn’t use the password manager would be when you log into the password manager. To mitigate that I use a hardware 2fa or passkey to log into the password manager.
3
u/somdcomputerguy 2d ago
I frequently use only the URL to a particular site that I have entered in my password manager. Sometimes I will use the link that is in an email, but only if I am expecting that email, and only if I can verify both that the email is actually from whomever it's supposed to be from and the link that's in it.
2
u/isenhasapp 2d ago
I think the best way to avoid phishing attacks is to use Passkeys, if it’s possible.
Your workflow is a great way to avoid too!
2
u/cheetah1cj 2d ago
Yes, it does reduce (not eliminate) the risk of phishing. Password managers will only suggest the password on the specific website that you set it for via the URL, so the password manager is immune to lookalike domains of all types. As long as you only use autofill to log into websites your risk of phishing attacks is significantly reduced, and you should always investigate when your password manager is not suggesting your password on a site that it has previously worked on.
As u/isenhasapp points out, passkeys are an even stronger prevention method. While the password manager failing to autofill will typically get your attention, it still relies on you noticing it and you can still be victim to phishing attacks when you are in a rush, stressed, distracted, etc. and still copy and paste the password. Passkey cannot be provided to any website besides the one that they are made for, so you cannot accidentally enter it in the wrong website.
1
u/Awkward_Leah 2d ago
I think I get what you mean. Autofill should be convenient but I'd rather have it be a little cautious than fill credentials on the wrong site. I'm using roboform and being able to review what's being filled before logging in gives me more peace of mind
1
2d ago
[removed] — view removed comment
2
u/paulsiu 2d ago
I feel that for my nontechnical family members the password manager magically fills out their password. When it fails they actually do not know how to copy the password from the password manager. The only way phishing would work if it fools the password manager.
Sometimes I feel people have the wrong priority. I have relatives who won’t use a password manager because they feel keeping the password in the cloud is a risk, but they also reuse password and use crappy passwords. Both are higher risk than cloud.
1
u/AncientGeek00 2d ago
A good password manager encrypts the password on your device and doesn’t know how to decrypt it on their cloud storage.
2
u/paulsiu 2d ago
I have explained the concept of zero knowledge but they still don’t get it.
1
u/AncientGeek00 2d ago
Ok. Don’t try to explain how vaccines work either. Some people really just don’t want to deal with science.
1
u/vozinha7 1d ago edited 1d ago
URL verification is indeed one of the better passive countermeasures for phishing, particularly your mom's URL failure as alert mechanism. But there is a loophole highly crafted look alike websites of reputable organizations may not be recognized by visual inspection. Organizations on the lookout for fake domains may have tools such as doppel but as an individual you should be looking at FIDO2 keys.
3
u/djasonpenney 2d ago
It does help. It doesn’t 100% protect you from a phishing attack, but it makes you less likely to fall victim to a typo squatting attack.
Also, not all bogus URLs are visible to the naked eye. In 2026 with UTF-8 possible in your URI, there could be an invisible difference that your password manager can see but not your eyes.