You are signed in. Close

You are signed out. Close

Thank you. Your subscription has started. Close

Thank you. You will get an email when a new comic comes out. Close

We could not confirm your payment. If you paid, use the link "Sign in" at the bottom of the page. Close

Something went wrong on our side. Please try again in a moment. Close

Project Visually
Random Sign in Subscribe
Previous episode Two-factor authentication: what a password alone cannot prove

How passwords and logins work: why a website should not know your password

Phishing: how a fake login page gets past two-factor authentication

You turned on two-factor authentication. A stolen password is not enough to get in any more. Then you get an email. It looks like it comes from a website you use, and it asks you to log in again.

  1. 1 An email says your booking at the gym was cancelled: log in to book again. The button leads to climbwa11.example. Look closely: two ones stand where the two l's should be.an emailclimbwall gymYour bookingwas cancelled.Log in tobook again.Log inclimbwa11.example

    An email says your booking at the gym was cancelled: log in to book again. The button leads to climbwa11.example. Look closely: two ones stand where the two l's should be.

  2. 2 The page looks exactly like the gym's. Rono built it to catch what you type, and a fake page made for that is called phishing. The lookalike name is his, so the page can even show the padlock.climbwall.exampleLog inemailpasswordLog inthe gym's pageclimbwa11.exampleLog inemailpasswordLog ina fake

    The page looks exactly like the gym's. Rono built it to catch what you type, and a fake page made for that is called phishing. The lookalike name is his, so the page can even show the padlock.

The rest of this episode is for subscribers

Subscribe to read every premium episode. You can cancel when you want.

Paid yearly: $99 instead of $119.88

Next episode Passkeys: how you log in to a website with no password at all

Share this comic

More comics