Doppelgänger

Stops phishing before anyone types a password: lookalike sites, copied sign-ins, streamed browsers, fake links and fake senders.

Stop phishing before anyone types a password. Doppelgänger is a free Chrome extension from Iden. It catches the phishing your employees can't tell from the real thing, and stops it on their own machine before a password goes in. There's no account and nothing to set up. What it stops: • Relayed sign-in. A shared file asks for a Microsoft sign-in, and it's Microsoft's real page, relayed through someone else's server: the password and the session your MFA approval creates both go to the attacker. Doppelgänger blocks a copy of Microsoft's or Google's sign-in page on any address that isn't theirs, before you type. • Streamed browser. A document viewer asks you to sign in again, and the sign-in is real: it's running in a browser on the attacker's machine, shown in your tab. Doppelgänger sees your keys going to a picture of a screen instead of a box on the page, and asks before one gets through. • Lookalike address. "аpple.com" with a Cyrillic "а" reads exactly like apple.com and gets its own padlock. Doppelgänger reads the letters, not their shapes: the page is replaced by "This is not apple.com" as it loads, with the fake letter named (а U+0430 · Cyrillic) and one click to the real site. Look-alike digits (paypa1), letter pairs (rn for m), small capitals, added accents, and real names buried in another address (apple.com-login.example) are caught too. • Fake link. "Verify your Apple ID" goes somewhere else. Links are marked before the click, in any webmail and through Outlook Safe Links, Proofpoint, Mimecast and Google's redirects: a red outline and a label ("Fake apple.com"), with the details on hover. • Impersonated sender. Your CEO's name asks Finance to wire $48,200 before 3pm, from someone else's address. In Gmail, a sender whose domain passes for yours or a company you know is marked ("Not acmecorp.com"), and a name you know writing from a new domain is marked "Usually from acmecorp.com". • Brand-new domain. A vendor's billing portal asks for your password, on a domain registered four days ago. Before the first password on any site you've never signed in to, Doppelgänger asks once, and says how new the domain is. • Typo domain. amazom.com asks you to update your payment details. A site one letter off a popular one, or off one you sign in to, gets a "Did you mean amazon.com?" note and a question before a password goes in. The question comes up on the page, in Doppelgänger's own card, however you reached the site. Say yes once and that site is remembered. A page that hides or covers the card gets Chrome's own dialog instead. If you continue to a blocked page anyway, a red banner stays on it and nothing can be typed or pasted until you confirm. Everything stays on the device. No account, no server, nothing to set up. Doppelgänger keeps the sites you sign in to, the sites you said yes to, and the display names on your Gmail senders, on this device only, and it never reads what you type into a password field. Its one network request asks a domain's registry when the domain was registered (over RDAP, the registries' replacement for WHOIS), because phishing domains are registered days before they're used. That request carries only the domain, goes straight to the registry and never to Iden, and one switch in the popup turns it off. For IT and security teams: one Chrome policy installs it on every machine, from Jamf, Kandji, Intune, Group Policy or the Google Admin console, and the domain lookup can be set by policy too. Guide: idenhq.com/doppelganger/deploy