Pilot preview. Entries marked Sample are illustrative and haven’t been technically reviewed or signed off yet.
The Haven Field Guide
Library
Every entry, organised by what you’re trying to figure out, not by when we wrote it.
Way in
Type
Topic
8 entries
- GuideDeploy Haven to everyone with Google WorkspaceIn the Google Admin console, add Haven by its extension ID under Chrome apps and extensions and set it to force install and pin. Or set the same policy with an ExtensionSettings policy file. Joining your Haven organization is a separate step.
- GuideHow can I tell if an email is real?Click the sender name to see the real address and read its domain. Hover over links before clicking. Treat urgency, generic greetings, unexpected attachments and any request for gift cards, crypto or a wire transfer as reasons to verify through another channel.
- GuideHow do I give finance or executives stricter Haven protection?Put them in their own Haven group and give that group a stricter policy: Active Enforce while everyone else is still monitored, more protected sites, a tighter extension allow list. A group's rules can tighten the organization's, never loosen them.
- QuestionCan a password manager protect me from phishing?Partly, and quietly. A password manager fills your login only on the domain where you saved it, so on a lookalike page it stays silent. Treat "why isn't it filling?" as a warning, not a glitch to work around by typing the password yourself.
- QuestionWhy does it matter if my browser is out of date?Browser updates often fix flaws attackers are already using, so an old version can be exploited just by opening a page. Chrome updates itself, but only finishes after a restart, and one that has stalled can stop prompting. Check your version now and then.
- Threat dossierHow does browser-in-the-browser phishing work?The page draws a fake sign-in pop-up, address bar and all, using ordinary HTML. Because that "window" is part of the page, you cannot drag it outside the browser tab, which is a quick tell.
- Threat dossierIs that email or text from the IRS real?Almost certainly not. The IRS doesn't start contact by email, text or social media to ask for information or payment; it sends letters. Refund or back-tax messages that arrive digitally are scams, as are fake tax-software sign-in emails. Type irs.gov yourself.
- Threat dossierIs that party or event invitation email a scam?Often. Fake invitations imitating services like Evite, Paperless Post or Punchbowl ask you to sign in with your email password to view them, or to download a "viewer" that is really remote-access software. Real invitations never need your email password.