A login page
Two boxes and a button. It is the least interesting screen in the collection to look at and the most expensive one to get wrong, and those two facts are related.
- What it is
- A form asking for a username, a password and usually a code
- Where you meet it
- After the queue, or straight away
- What it settles
- Nothing whatsoever
- Cannot tell you
- Whether the thing collecting your password is the market
The specimen
username [________________]
password [________________]
2fa code [______]
[ Sign in ] ← everything before this point is reversible
A login form, and the only moment that matters on it. Up to the button you have given away nothing. After it you have given away everything the form asked for, including the code, which is why the check belongs before the typing and not after something feels wrong.
What a copy collects
- The password, in the clear, because you typed it into their box.
- The code, if you supply one, which gets replayed against the real market inside the window it is valid for.
- The session, in the versions that pass your input through to the real site so the login appears to succeed. That removes the only symptom you had.
- Your message history, once inside, which is frequently worth more than any balance.
Why nothing on the page helps
| What people check | What it is worth |
|---|---|
| The layout looks right | Nothing. It is the same file |
| It loaded quickly | Slightly worse than nothing. See the note on speed |
| The address starts correctly | Nothing on its own. That is the near miss |
| A friend sent the link | Nothing. Trust does not carry over |
| A signature checked against a pinned fingerprint | This one. Only this one |
If you have already typed
- Get in through an address you checked yourself, not the one you were just on.
- Change the password to something used nowhere else, and change it everywhere you reused it.
- Reset the second factor and save the new recovery material before you close the page.
- Read the messages, then the balance. In that order, for the reason above.
If what you handed over included a code rather than only a password, treat it as live right now. That is one of the few places in this collection where hurrying is the correct response, and it is because something has already gone wrong rather than because somebody is offering you something.
The one habit that makes this specimen harmless
Check before typing, not after something feels off. By the time the form looks wrong the credentials are already gone, and every remedy from that point is damage control. The whole value of a signature check is where it sits in the sequence, which is also why it is the step most often skipped: it costs a minute at the exact moment you have already decided you are in the right place.