Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Is My Credit Card Stolen? (A ruse to educate people about phishing)

ismycreditcardstolen.com

Post reply on HN
Print view View original

1–10 of 40 posts

Re: Is My Credit Card Stolen? (A ruse to educate people about phishing)

#3

Post by pquerna »

ROFISH wrote: post #2

You know what, this is a phisher's dream. Even if we could trust this website for not saving the data, the connection is a regular non-secure connection, so all somebody would have to do is catch some open wireless connections or similar.

we have applied for an SSL certificate, from both GoDaddy and Comodo.

they are both 'pending', since apparently, having 'credit card' in your domain is suspicious: http://ismycreditcardstolen.com/anti-phishing.jpg

Re: Is My Credit Card Stolen? (A ruse to educate people about phishing)

#4

Post by AngryParsley »

ROFISH wrote: post #2

You know what, this is a phisher's dream. Even if we could trust this website for not saving the data, the connection is a regular non-secure connection, so all somebody would have to do is catch some open wireless connections or similar.

View the HTML source. The credit card inputs aren't part of the form. They're never sent across the wire.

Re: Is My Credit Card Stolen? (A ruse to educate people about phishing)

#8

Post by AngryParsley »

iaskwhy wrote: post #7
sbov wrote: post #5

I submitted no data and it still said I failed the test?

I guess you're not supposed to submit these kind of forms, even if empty.

Nah, I'm just lazy and didn't write any JavaScript to validate the inputs.

Edit: yeah I would normally never use JS for validation.

Re: Is My Credit Card Stolen? (A ruse to educate people about phishing)

#9

Post by generalk »

Interesting concept!

I'd remove the negativity from the start. Putting "This is a test, you have failed it" right in front of folks is an instant turn-off, and might lead people away from your page instead of to the helpful content below.

More bullet points. There's not a whole lot of text there now, but anything you can do to get the message across with fewer words is a win, especially when dealing with non-technical folks.

Under "look at the address bar", you have: A common phishing trick is to have a domain like amazon.com.not.ru, which steals your credentials when you try to log in. The actual domain in this example is "not.ru," but people often only check to see if the string "amazon.com" is anywhere in the address bar.

I'd change that to not use the word "string" since non-tech-folks don't parse that very well, and maybe include screenshots of an address bar containing the real Amazon.com and a phishing site disguised as Amazon.

Still though, good idea!

Re: Is My Credit Card Stolen? (A ruse to educate people about phishing)

#10

Post by AngryParsley »

generalk wrote: post #9

Interesting concept! I'd remove the negativity from the start. Putting "This is a test, you have failed it" right in front of folks is an instant turn-off, and might lead people away from your page instead of to the helpful content below. More bullet points. There's not a whole lot of text there now, but anything you can do to get the message across with fewer words is a win, especially when dealing with non-technica…

Thanks for the suggestions. If you want to make changes, you can fork http://github.com/pquerna/darwintest .

Edit: I used the "you fail" message because I think it makes people more likely to remember it. I wanted to say something like "your credit card has been stolen. kthxbye." but that would have caused some false alarms.

It's hard to have a memorable message without it causing offense or panic.

Also on my TODO: add a counter for those who put 16 digits in the credit card field.

Extra edit: nfriendly: Thanks for the styling suggestion.

Post reply on HN