@nolan @bcrypt

No, you're right; it's a pretty nasty UI element that's just asking for trouble.

@munin @nolan @bcrypt what'd be neat, I think, is if your browser could pull out the account link and give you a one-click URL bar follow button, like RSS used to have. Just one man's opinion.

@nolan @munin @bcrypt what would be the modus operandi, exactly? how could some phish and what could they gain?

@rysiek @nolan @bcrypt

Rig the 'remote follow' button to direct to a page I control with the credentials dialogue; on the backend, collect credentials and relay 'em to the 'correct' location to complete the follow.

@munin @rysiek @bcrypt Yes also if you're an admin and you don't have 2FA set up then getting your password is especially valuable.

@nolan
True that if an admin enters his/her username and password in a page without checking where he/she is then he/she should be banned for being an admin of anything ;-)

Anyway it seems like if I'm already logged in my instance the remote site only asks for the username which is OK.

@munin @rysiek @bcrypt

@paolov @nolan @rysiek @bcrypt

"You should know better" is not a valid argument.

If you are logged in, then yes - but the option is available -to- log in if you're not, which opens this UI hole to exploitation.

@munin
Yes I do agree, I was just being a bit cheeky.

It is a UI (and UX) issue which is difficult to fix as there are many ways to trick a user.

I'm for the radical solution of requiring the user to log-in from his/her home instance before "remote following" or similar.

@nolan @rysiek @bcrypt

@munin @nolan @bcrypt ah, of course. Dang, should have thought about that. That's a very valid point!

@rysiek @nolan @bcrypt

Now, the -legitimate- one will redirect you back to your home instance...

...but every instance has the same livery by default; there's really no obvious 'tells' other'n if you're paranoid enough to watch the URL bar, and most people aren't.

@bcrypt @nolan @rysiek

A potential mitigation would be to load foreign threads in an iframe in your own instance, with the 'follow remote user' button clearly from your home instance.

But that'd be kinda hinky :-/

@munin @nolan @bcrypt one simple-ish solution would be to *require* users to set a "security picture", some bank websites use that.

@frankiesaxx Only if you're already logged in. Try in a private browser window.

@quirst It's a button that literally says "remote follow." 😉 You can check the profile of a remote user that you don't follow to see what I mean; if you're at example.com/@username then you'll see it.

@neither Yes you have to click on the profile pic to see the full number. It's complicated and has to do with which users your instance is "aware" of. 🙂