The email that was one letter off
The URL was one letter off, and the verification code was stolen too.
(Illustrative scenario, not a real incident)
At this fifteen-person internet services company,A-Cheng, the engineering lead,got an email from the domain registrar:“Your domain is about to expire. Please log in to renew.”
He clicked the linkand entered his username, his password,and the verification code sent to his phone.
A few hours later,the website’s settings had been changed,and some visitors were being redirected to another site.
Looking back at the email,the address was one letter off.
The company’s core systems were all behind single sign-on.But the domain, the cloud root account,the ad dashboards, the various admin accountsweren’t part of it.They relied on passwords alone, a text-message code at most.
And yet those are the accounts with the most power.
The password and code you type into a fake sitecan be relayed to the real site in real time.The verification code, too,can be phished.
I used to think that adding a verification codemade it foolproof.Later I realizedpeople misread letters,but some keys only recognize the real door.
A dike a thousand miles long can collapse from an ant hole.One letter is enough.
Accounts outside single sign-on, such as the domain, the cloud root account, and ad dashboards, should move to passkeys first; a passkey only works with the real site, so a fake site can’t steal it.