Typing a URL vs Googling a URL

If you’re trying to go to an important website, who do you trust more: yourself or Google?

Let’s say you’re trying to go to Wells Fargo to log into your bank account. Would you rather go to Google and type in “Wells Fargo” and click on the first search result? Or would you rather type “wellsfargo.com” into your browser?

If you choose to go the Google route, you put yourself at risk for all kinds of link “poisoning” problems. The first search result may look right, but maybe it’s a phishing attack that somehow floated to be the first search result. And even if the URL looks right, how do you know the letters haven’t been replaced with Unicode characters and it’s actually sending you to the wrong place?

However, if you choose to go the DIY route, you’re still potentially going to have problems. One little typo (say “wellfargo.com”) may send you to a phishing site as well!

So what are we supposed to do?

Personally, I take the Google route. I rely on Google’s algorithms to keep me safe. I trust it more than I trust myself to not accidentally type “wellfargo.com”.

Your browser’s auto-complete function is also very useful. If you went to the site once, logged in, and actually saw your bank account info, then it’s probably the legit site and you should go to it again.

Last, but not least, is to use a password manager to keep things organized for you. (Personally, I use KeepassXC.) Any decent password manager will let you store a URL alongside the usual username and password information. You should be able to launch the URL from your password manager. (For KeepassXC, the default is ctrl-U or cmd-U.) With this approach, at least you’ll consistently be visiting the same URL to type in the same user/pass combination. The onus to ensure the URL is actually real, correct, and safe is completely on you.

I hope that helps! Just some food for thought in this crazy 2018 year.