How responsible is this if you allow the domain to expire someday - or your email gets hacked and a foreign party takes control over your domain name?
Is My Credit Card Stolen? (A ruse to educate people about phishing)
21–30 of 40 posts
Re: Is My Credit Card Stolen? (A ruse to educate people about phishing)
#22Earlier quoted context omitted.
View the HTML source. The credit card inputs aren't part of the form. They're never sent across the wire.
This doesn't matter. If the connection is intercepted, the credit card inputs suddenly can be part of the form.
That's true for any non-https site. They could inject stuff into wellsfargo.com or whatever.
Re: Is My Credit Card Stolen? (A ruse to educate people about phishing)
#23This is remarkably similar to the site my friend Leon set up, which he artfully called "Creditcardology" - see http://secretgeek.net/cco/CCO.HTM
Re: Is My Credit Card Stolen? (A ruse to educate people about phishing)
#24I havent particularly been following it, but is there any real solution to phishing? with punycode domains and arbitrary tld's, along with characters that look the same in a lot of fonts, l and I, people need a cs degree to figure out if they are being phished.
I guess paypal and a small number of verified payment processors, (or real online banking) are about the only option.
Re: Is My Credit Card Stolen? (A ruse to educate people about phishing)
#25"If asked for your password, do not give it out. Real websites will never ask you for your password. (Login forms excepted, of course.)" This is confusing, in my opinion. It's hard to explain the difference between a login form and a page asking for your password, so it's probably worth just leaving this out. Any phisher worth his salt makes the page asking for a password look like a login form anyway.
You're right. It will be fixed whenever pquerna gets back from the Cassandra get-together.
Re: Is My Credit Card Stolen? (A ruse to educate people about phishing)
#26I havent particularly been following it, but is there any real solution to phishing? with punycode domains and arbitrary tld's, along with characters that look the same in a lot of fonts, l and I, people need a cs degree to figure out if they are being phished. I guess paypal and a small number of verified payment processors, (or real online banking) are about the only option.
Single-use credit card numbers (and one-time passwords) would help a ton. Multifactor authentication of any kind would also be good. The problem with all of these ideas is that they're harder to use than fixed CC numbers and passwords.
I do like the convenience of being able to memorize a password or CC number though.
Re: Is My Credit Card Stolen? (A ruse to educate people about phishing)
#27I tried to find a way to pass the test and couldn't. Could someone explain to me how to pass?
That's strange, e-mail me your credit card info and I'll verify it manually.
Re: Is My Credit Card Stolen? (A ruse to educate people about phishing)
#281) Create an online form that doesn't take input, and call it "educational".
2) Get a bunch of educated people to review it for 3-5 days and approve of it.
3) Wait until the educated people send links of this to their non-internet literate friends, for education, shits and harmless giggles.
4) Switch to a live form that captures data.
Re: Is My Credit Card Stolen? (A ruse to educate people about phishing)
#29Last week, I posted something similar to proggit using the youtube redirect exploit.
During its three-hour run, nearly 6000 people (20%) tried to give me their google account credentials.
http://www.reddit.com/r/programming/comments/bpy7h/think_you...
Re: Is My Credit Card Stolen? (A ruse to educate people about phishing)
#301) Create an online form that doesn't take input, and call it "educational". 2) Get a bunch of educated people to review it for 3-5 days and approve of it. 3) Wait until the educated people send links of this to their non-internet literate friends, for education, shits and harmless giggles. 4) Switch to a live form that captures data.
5) ...
6) Profit