How to Detect the Authentic CalNet Login Page

A knowledge base article about How to Detect the Authentic CalNet Login Page provided by the UC Berkeley IT Service Hub - Knowledge Portal

How to Detect the Authentic CalNet Login Page

Phishing exploits are one of the biggest security threats facing the UC Berkeley campus. Fraudsters commonly target campus users with well-crafted emails to lure them to a counterfeit CalNet login page. Users tricked into entering their CalNet login and password have compromised their account, giving free rein to the hacker to access private information and to perpetuate their scam to other users.

To help protect your CalNet account and sensitive data, follow the campus Top 10 Secure Computing Tips and learn about Protecting Your Credentials. When you do come across a website that asks for your CalNet account login, you should always verify the authenticity of the website.

The CalNet login page (sometimes referred to as the CalNet "Central Authentication Service" or CAS) has several unique security identifiers that can help you to verify the site and protect you from falling prey to a phishing scam.

Screenshot of the official UC Berkeley CalNet login page showing the CalNet ID and Passphrase entry fields with the blue Sign In button and the CalNet logo.

The screenshot above shows what the CalNet login page should look like, but appearance is not a determining factor in trusting a website since the page can be easily forged.

Step 1: Verify the URL Address

Verify that the beginning of the URL for the CalNet login page always begins with: https://auth.berkeley.edu

Close-up of a web browser address bar highlighting the authentic domain name auth.berkeley.edu with a padlock icon indicating a secure connection

Step 2: Verify the SSL Certificate

The second step is to verify the site SSL certificate (steps vary per browser):

  1. Click the padlock icon in the address bar and select "Certificate" from the dialogue box.
    A browser security menu opened from the padlock icon, showing options such as Connection is secure and Certificate is valid
  2. View the details of the certificate to verify the following items:
    1. Look for "This Certificate is Valid" or "This certificate has been verified"
    2. Under "Subject Name" or "Issued To" section:
      1. Organization (O) name is: University of California, Berkeley
      2. Common Name (CN) is: auth.berkeley.edu
    3. Under "Issuer":
      1. The Organization (O) value is: InCommon ECC Server CA 2
      2. Common Name (CN) is: Internet2