SSO No Phishing — kang

This web extension will:

1) Give clear, trusted, positive feedback that you're on the correct login page

It will change the theme color of Firefox temporarily (to green) when you're entering your credentials on a white-listed domain (i.e. a domain that is authorized to handle your credentials). This list can be customized in the extension's preferences if necessary.

2) Detect when your credentials are sent to a site that isn't white-listed

It will capture and record a salted hash of your credentials the first time you enter them after the extension was installed. It then monitors for data posted to websites and if anything matches your credential hash, it will prevent Firefox from sending the credentials. For example if you enter your Mozilla LDAP credentials on a site that isn't using Mozilla IAM SSO for example, it will prevent the credentials from being sent and warn you about it.
SECURITY RELEVANT INFORMATION: The detection is opportunistic and there are known ways to bypass the detection. While it will most likely detect most phishing attempts, an advanced attacker could work around this protection.

This second option can be turned off in the extension preferences.