41–50 of 103 posts
"The link mailto:”support@paypal.com” shows up as “support@paypal.com” in the Google Inbox composition window, visually identical to any email actually sent to PayPal."
It has been fixed in the web version, but apparently the Android app still has this issue
Hi All, I posted this here because I think it's great there's some effort being put into free training in this region. I do however agree with some of the comments here. I had been hunting for something like this to use as our own training, but it won't be this because I don't agree with the TripIt example. Edit: Maybe there should be a "maybe" or "consider" answer. "This is a legitimate company. However, their desir…
A technical solution to security should be sought out as well. This doesn't remove ANY responsibility from companies for having good security.
It does help to empower the less technical users.
Phishing, especially the targeted type, is impossible to combat at scale, and expecting users to know the ins and outs of what's a safe domain (withgoogle.com? Is it safe or not?) or to try to identify legitimate communications is a stupid waste of time. Long term the solution is ubiquitous hardware-based 2FA, ideally incorporated into the physical devices themselves.
True, but a solution doesn't have to be single sided. I can easily send this link to my parents and then they know a little more. Expecting users to know is ridiculous, but offering tools for people to help educate their less tech savvy loved ones is awesome. That's kinda how I see this. It helps me empower my parents a little more.
This quiz isn't it, though. You and I know what domains are; we know what's possible; we can sense when somethings off. It's our bread and butter. The average user knows none of these things, and giving them a dozen rules to follow that will work a lot of the time is in the end confusing.
A better set of rules to link your parents to is this:
1) Trust nothing over email. If your bank sends you a notification, don't click on the link in your email: just go directly to your bank's website and log in.
2) That's about it.
As for the TripIt we may don’t have the same definition of fishing
As the mail was a ligitime mail from google to request access to my account from an app (and that’s what’s about the quizz) as for if did I used that app or now that’s another story
Earlier quoted context omitted.
withgoogle.com is more of a 'sandbox' for Google one-off programs, labs, events, etc. which don't need to have the same branding guidelines as on google.com domain.
...so? It's still a phishing vector. Teaching users that sometimes Google throws together half-assed domains encourages them to trust any domain with "google" in it.
workingoogle.com labsgoogle.com labsatgoogle.com learngoogle.org learnatgoogle.com youatgoogle.com bygoogle.co securitywithgoogle.com mailatgoogle.com realgoogle.com
etc.
Seems odd to me that they would encourage allowing 3rd party sites to read all your email, but I guess this is where we're at right now
Yeah, that's the only reason I got a question 'wrong'. Sorry, but no third party app is getting access to my email for obvious security reasons. Doesn't matter how 'legit' the company is or what not.
- host your own email...
- on your own hardware...
- with your own software (hopefully doing end to end encryption)
Even then your surely not running your own fiber, though things like STARTTLS help mitigate this vector.
I only mean to say, some level of trust is assumed. But yea, you should aim towards less buggy, evil corporate dependencies.
Seems odd to me that they would encourage allowing 3rd party sites to read all your email, but I guess this is where we're at right now
Earlier quoted context omitted.
True, but a solution doesn't have to be single sided. I can easily send this link to my parents and then they know a little more. Expecting users to know is ridiculous, but offering tools for people to help educate their less tech savvy loved ones is awesome. That's kinda how I see this. It helps me empower my parents a little more.
I agree that it doesn't have to be single-sided, and we need multiple angles to protect against phishing. This quiz isn't it, though. You and I know what domains are; we know what's possible; we can sense when somethings off. It's our bread and butter. The average user knows none of these things, and giving them a dozen rules to follow that will work a lot of the time is in the end confusing. A better set of rules to…