Humans Are Bad at URLs and Fonts Don’t Matter • Hacker News Board

Re: Humans Are Bad at URLs and Fonts Don’t Matter

#91

Post by bleepblorp » Thu, Oct 29, 2020, 11:55 PM UTC

Nextgrid wrote: post #84

bleepblorp wrote: post #29

Earlier quoted context omitted.

A lot of phishing, and other online financial crime, is perpetrated by groups operating with the support of their home governments. There's no way to hold North Korean state-backed phishing/criminal hacking groups accountable without disconnecting North Korea from the Internet or going to war with them. Similar issues apply to curtailing online crime committed by Russian mafia entities, as they are well connected to…

Are there any sources for this? I'm not saying what you're saying is true, but I have a hard time believing the majority of scams and spam out there is state-sponsored as opposed to independent bad actors, and if accountability can at least weed those out then that's still a win.

North Korean state-sponsored criminal fraud activities:

https://www.zdnet.com/article/north-korea-s-apt38-hacking-gr...

https://www.cnn.com/2019/03/01/politics/north-korea-cyberatt...

Connections between specific Russian financial crime organizations and the Russian government are much harder to pin down as people who try to investigate ties between the Russian mob and the Russian government often wind up dead. However, the Russian government is well known to be tightly linked connected to Russian organized crime[0]. Given the sheer scale of Russian financial fraud operations--Carbanak stole upwards of a billion USD[1]--the balance of probabilities suggest these operations exist with the tacit approval of the Russian government.

[0] https://bpr.berkeley.edu/2019/12/16/gangs-and-gulags-how-vla...

[1] https://securityintelligence.com/carbanak-how-would-you-have...

Re: Humans Are Bad at URLs and Fonts Don’t Matter

#92

Post by invokestatic » Thu, Oct 29, 2020, 11:59 PM UTC

ZoomZoomZoom wrote: post #83

I always wondered why don't browsers highlight the address bar with the color sourced from the domain hash? If my bank's site is always pink but after clicking a link it's suddenly teal, could it get any easier? When https green shields and locks appeared at first I thought it's something like that, only to be disappointed.

I don’t think there are enough unique human distinguishable colors to make this worthwhile. I imagine it wouldn’t be too hard to find a “collision”.

Re: Humans Are Bad at URLs and Fonts Don’t Matter

#93

Post by tatersolid » Fri, Oct 30, 2020, 1:54 AM UTC

julianozen wrote: post #30

jniedrauer wrote: post #27

A browser-based password manager mostly solves the confusables problem. If your password manager matches by domain name, and someone tries to phish you, it will immediately clue you in that something's not right. Unfortunately this doesn't solve the problem in general, because most people don't use password managers.

And I frequently need to add alternative trusted URLs to 1Password so that auto fill works on the same authentication across different domains (this I find I need often for like banks)

Airline sites are the worst in this regard. United, American, Delta, etc. bounce you around between multiple phishy-looking domains to redeem miles or use their benefits. And none of them use their own site as a proper OpenID connect or OAUTH IDP and require re-logging in with your airline username and password on different domains!

Re: Humans Are Bad at URLs and Fonts Don’t Matter

#94

Post by tatersolid » Fri, Oct 30, 2020, 1:58 AM UTC

amelius wrote: post #77

I'm thinking we could at least implement a whitelist for banks, and show a banking symbol in the url bar. Then educate people about this.

There are over 10,000 financial institutions in the USA alone. The FDIC and OTS have lists of them all, but none contain their approved internet domain names. This isn’t as easy as you’d think.

Re: Humans Are Bad at URLs and Fonts Don’t Matter

#95

Post by ClumsyPilot » Fri, Oct 30, 2020, 2:02 AM UTC

jcranmer wrote: post #15

RcouF1uZ4gsC wrote: post #4

This is one of the reasons why I think it was a mistake for the web browsers to de-emphasize EV certificates. Precisely because they are expensive and difficult to get automatically, they can be a an extra protection against phishing. I fear that because of these kind of URL issues, and with the deemphasis of EV certificates which would have provided a somewhat decentralized solution, we will end up in a world where…

> Precisely because they are expensive and difficult to get automatically, they can be a an extra protection against phishing. And the requirement for an EV certificate is that it has to be registered specifically in the corporate name, which isn't necessarily the well-known trade name. Furthermore, anyone could choose to register their company as, say, "Microsoft" if it's not in the same jurisdiction as the actual M…

"specifically in the corporate name, which isn't necessarily the well-known trade name"

If you 'verifying' without knowing the legal identity, what on earth have you verified? Perhaps we could include trademarks somehow, but at the end of the day having weired names is down to the firm.

The example with google blogs was particularly apt - all URLs are legit, but only one belongs to Google. I want to know which one.

Re: Humans Are Bad at URLs and Fonts Don’t Matter

#96

Post by captn3m0 » Fri, Oct 30, 2020, 2:46 AM UTC

RcouF1uZ4gsC wrote: post #4

This is one of the reasons why I think it was a mistake for the web browsers to de-emphasize EV certificates. Precisely because they are expensive and difficult to get automatically, they can be a an extra protection against phishing. I fear that because of these kind of URL issues, and with the deemphasis of EV certificates which would have provided a somewhat decentralized solution, we will end up in a world where…

Sadly research has proven otherwise:

1. Users do not understand the difference between an EV and a DV cert. We spent a decade training users that the padlock is all you need.

2. Company registration norms are not standardised across the world, and you can easily get a certificate for Microsoft Corp, see https://news.ycombinator.com/item?id=15904513 for eg.

Re: Humans Are Bad at URLs and Fonts Don’t Matter

#97

Post by 0xdeadb00f » Fri, Oct 30, 2020, 3:50 AM UTC

jonny_eh wrote: post #88

ljm wrote: post #87

Earlier quoted context omitted.

He loses my respect with that. NordVPN isn't without its problems and he's also selling a VPN that monitors your browsing to detect this stuff. A VPN that grows by underselling itself all over youtube isn't one I want to be a customer of. If he wants to use his rep to write fluff pieces for his corporate sponsor, so be it. But he discredits himself for doing so.

> A VPN that grows by underselling itself all over youtube You're avoiding a service because it sponsors content you enjoy?

Yes.

Re: Humans Are Bad at URLs and Fonts Don’t Matter

#98

Post by bradknowles » Fri, Oct 30, 2020, 4:02 AM UTC

I’m confused. I think Troy has been pretty open about his relationship with 1Password and NordVPN.

So, he writes an article about a service related to these companies which helps to solve a real issue.

So, why all the hate?

Re: Humans Are Bad at URLs and Fonts Don’t Matter

#99

Post by darkerside » Fri, Oct 30, 2020, 4:25 AM UTC

hombre_fatal wrote: post #72

darkerside wrote: post #63

Earlier quoted context omitted.

I would posit that for normal run-of-the-mill communications, anonymity is overrated. What is this edge case of politically sensitive communications that you think is at risk?

Most HNers here including yourself are writing comments with the comfort of anonymity. I don't want to worry about anything I have to say being tied to my identity, whether it's even my thoughts that there's nothing wrong with a "master" branch much less my much more unsavory thoughts in the tech space.

Isn't it possible that people become more comfortable attacking common sense opinions like that because they are only expressed in pseudonymity? If the veil were lifted, we'd all have to stand behind our opinions, and people who wanted to disagree would have to do it to our faces. Maybe removing humanity from the internet is not the panacea it seems?

Re: Humans Are Bad at URLs and Fonts Don’t Matter

#100

Post by dwheeler » Fri, Oct 30, 2020, 4:28 AM UTC

pvorb wrote: post #79

dwheeler wrote: post #67

Why must there be exactly one solution that solves everything? We don't expect that anywhere else in life. Obviously it's best if there was a simple automated solution that worked in all cases, but there is no such thing. Password managers are great, but they don't counter disinformation from sites you don't have a password with. Preventing access to malicious sites only works if it's known to be malicious; new sites…

A few years ago, I had this idea of using identicons to visualize the host part of URLs: https://vorba.ch/2018/url-security-identicons.html I still think this could help people realize when they are being phished at least for their most important sites in a privacy-respecting way, even if they don't use a password manager for those sites. I don't use my password manager for my banking account, for instance, since I d…

Attackers will then work to find domain names that generate similar identicons.

But maybe the identicons don't need to be meaningful or the same for everyone. You could hash the domain with another value, like a computer name or username, then show some interesting pattern. Then it would have a different pattern. Not perfect, but yet another user cue.