Google Phishing Quiz • Hacker News Board

Re: Google Phishing Quiz

#11

Post by justusthane » Tue, Jan 22, 2019, 10:09 PM UTC

cbanek wrote: post #9

I missed two: the "allow some random person to read your email" which I would never click on, and the one that had a PDF, even though they don't allow you to do anything with it. Just because someone sends you a PDF doesn't mean it's an attack vector. It would have been more helpful to say something like "this is someone you do business with as well, or someone you've never heard of." (which I find to be more useful…

On the PDF one, it tells you in the "intro" blurb that the sender's email address is wrong. Should be .edu and it's .org.

Re: Google Phishing Quiz

#12

Post by [deleted] » Tue, Jan 22, 2019, 10:10 PM UTC

[deleted]

Re: Google Phishing Quiz

#13

Post by cbanek » Tue, Jan 22, 2019, 10:10 PM UTC

justusthane wrote: post #11

cbanek wrote: post #9

I missed two: the "allow some random person to read your email" which I would never click on, and the one that had a PDF, even though they don't allow you to do anything with it. Just because someone sends you a PDF doesn't mean it's an attack vector. It would have been more helpful to say something like "this is someone you do business with as well, or someone you've never heard of." (which I find to be more useful…

On the PDF one, it tells you in the "intro" blurb that the sender's email address is wrong. Should be .edu and it's .org.

Ah thanks, I must have missed that. If it's the wrong address then definitely suspect.

Re: Google Phishing Quiz

#14

Post by tapland » Tue, Jan 22, 2019, 10:11 PM UTC

This works very similarly to HoxHunt: https://tech.eu/brief/finnish-startup-hoxhunt-secures-e2-5-m...

Re: Google Phishing Quiz

#15

Post by dddddaviddddd » Tue, Jan 22, 2019, 10:13 PM UTC

orastor wrote: post #3

Seems odd to me that they would encourage allowing 3rd party sites to read all your email, but I guess this is where we're at right now

Could understand if it was a desktop or mobile email app using the API though.

Re: Google Phishing Quiz

#16

Post by zulln » Tue, Jan 22, 2019, 10:13 PM UTC

A bit annoying that the fact that Dropbox used HTTPS-links are highlighted as a sign of it being legit. I have always suspected such advices makes people think HTTPS are actually somehow magically secure, while it has nothing to do with phishing related issues.

Re: Google Phishing Quiz

#17

Post by jtokoph » Tue, Jan 22, 2019, 10:17 PM UTC

While the domain is a legit Google domain, I find it ironic that it’s hosted on “withgoogle.com”. If my parents followed my anti-phishing tips they would fail by clicking this link.

Re: Google Phishing Quiz

#18

Post by julianozen » Tue, Jan 22, 2019, 10:18 PM UTC

I wanted to point out one of the phishing schemes used a google amp link to disguise a URL as being from google..... sigh

Re: Google Phishing Quiz

#19

Post by jopsen » Tue, Jan 22, 2019, 10:20 PM UTC

cbanek wrote: post #8

orastor wrote: post #3

Seems odd to me that they would encourage allowing 3rd party sites to read all your email, but I guess this is where we're at right now

Yeah, anyone asking for that, even if it's not a phishing attempt would never get the OK from me. That's just crazy.

I suppose it might make sense if you were installing a 3rd party gmail application on your desktop.

I'm no oauth expert, but I would imagine an app would go through a flow like this.

Re: Google Phishing Quiz

#20

Post by cbanek » Tue, Jan 22, 2019, 10:25 PM UTC

jopsen wrote: post #19

cbanek wrote: post #8

Earlier quoted context omitted.

Yeah, anyone asking for that, even if it's not a phishing attempt would never get the OK from me. That's just crazy.

I suppose it might make sense if you were installing a 3rd party gmail application on your desktop. I'm no oauth expert, but I would imagine an app would go through a flow like this.

I believe you can connect gmail to your local email client using IMAP/POP3, but I don't think that uses the oauth flow to do that (you just type in the password). I've never used any other kind of 3rd party gmail apps though.