Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The short tale of an online scam

duarteocarmo.com

Post reply on HN
Print view View original

71–80 of 98 posts

Re: The short tale of an online scam

#71

Post by jrochkind1 »

lovelyviking wrote: post #38
jrochkind1 wrote: post #29

Earlier quoted context omitted.

One of the justifications is that showing only the hostname will make it easier to recognize malicious hostnames; as it is, the typical non-technical user just sees a bunch of stuff, doesn't really know how to distinguish hostname from path. I buy it honestly.

how they suppose to learn about it or at least be curious about it if they do not even see it? >I buy it honestly. phishing should look nice to the victim?

The idea is not to make phishing look nice to the victim, it's to make it more obvious that it's phishing to the attempted victim. The path component is irrelevant to detecting phishing, but the host component is very relevant.

I don't know if there's any research on users to confirm that this works. It would be good to do such research before making such a change, if that's the motivation for the change. But it seems plausible to me.

Re: The short tale of an online scam

#73

Post by GrinningFool »

pwned1 wrote: post #65
mnd999 wrote: post #3

Namecheap. Surprise. They seem to be the preferred DNS provider for this sort of thing.

99% of the phishing domains that target my company's site come from Namecheap. I don't know why they can't get their act together when it comes to fraudulent domain registration.

What would you expect them to do to stop it? Also, what makes it fraudulent?

It may be registered with fraudulent intent, but the business transaction used to register it is likely perfectly legitimate.

Re: The short tale of an online scam

#74

Post by jimmaswell »

axiosgunnar wrote: post #72

Hold on! If I wanted to sell some furniture and somebody wanted to use a mover service, that somebody would be paying for it, right? Why did OP ever proceed with a form that wanted HIS payment details?

I assumed he knew it was a scam already and put in fake info

Re: The short tale of an online scam

#75

Post by bob1029 »

I just had an app idea. I am super busy right now, but maybe someone can run with it - You could build a website verification service+app.

Produce a mobile app which uses the camera to scan QR codes, or even watermarked/"invisible" elements placed in reasonable locations on the user interface.

Release an API/SDK which allows for any network participant to quickly wire up a security verification front on their webapp (this would be a bit of js).

App and API obviously both talk to your back-end, wherein the network participants have submitted substantial business/entity verification documentation prior to being added to the network. The service is pretty damn simple - just cryptographic signatures that rotate every few seconds or something. Keep track of last ~100 to account for clock drift. No need to make it hard.

Provide application as free service to users. Monetization possible via a few routes. Ads on the user app itself, B2B contracts with network participants, etc.

Use case A: Get to final payment screen on https://www.bhphotovideo.com. User wants to be 200% sure they are not about to bank wire five figures to Putin due to some UTF8 technicalities. User takes their iPhone out, taps "my magic verification app", points at payment screen, app dings with big green check mark, post verification ad experience, et. al.

Re: The short tale of an online scam

#76

Post by handrous »

aeorgnoieang wrote: post #68
3np wrote: post #16

An obvious red flag for me is always an opening message with "I'm interested in X", where "X" is verbatim copied off the title of the ad.

I think I do that, on the off chance that a person might have multiple listings, and my general preference for precision. I probably also figured it'd be easier for them to know what I was referencing if I used the exact same text.

Prominently featuring the exact text of my listing title has, so far, been a 100% perfect match for scams, for craigslist ads. Doesn't quite catch all of them, but the ones that do that have always been attempted scams.

Re: The short tale of an online scam

#77

Post by teddyh »

elliekelly wrote: post #54
_jal wrote: post #40

Earlier quoted context omitted.

It isn't just Google. Multiple browsers have flirted with hiding it. There are various mindsets that lead to want to do that - one designer I know calls it a debugging tool that should never have been released in the first place. For others, it is clearly about controlling the user with various justifications. (I consider it a canary. Its removal will be a signal that the HugeCos are comfortable relegating the non-co…

> one designer I know calls it a debugging tool that should never have been released in the first place I've heard similar comments but I don't understand how people would be expected to navigate around the internet? Is the idea that Google's search input should replace it? So if I want to go to sec.gov I should search SEC and click the link (hopefully) provided at the top of the results rather than just go there dir…

In my limited experience, most browsers do what you describe already. Unless you type a 100% correct URL (and sometimes even if you do), a normal browser will send your URL string to Google (or similar entity), who will send back a redirect. The process is fast enought for you not to notice.

It is often possible (if hard) to configure browsers to do traditional URL resolving, but I wouldn’t bet on it always being possible. Google certainly has every reason to disallow reconfiguring their own browser to not send data to Google.

Re: The short tale of an online scam

#78

Post by throaway3141593 »

_jal wrote: post #40
thereddaikon wrote: post #26

Earlier quoted context omitted.

There has also been a push by Google and others lately to "dumb down" the url bar to hide the full address from users. Not sure why but I assume the justification would be some misguided attempt at making it look nicer while the real reason is somehow ad related.

It isn't just Google. Multiple browsers have flirted with hiding it. There are various mindsets that lead to want to do that - one designer I know calls it a debugging tool that should never have been released in the first place. For others, it is clearly about controlling the user with various justifications. (I consider it a canary. Its removal will be a signal that the HugeCos are comfortable relegating the non-co…

> Multiple browsers have flirted with hiding it.

Safari has been doing this for a while now, yet no one is up in arms about it.

Re: The short tale of an online scam

#79

Post by throaway3141593 »

JadeNB wrote: post #27
thereddaikon wrote: post #26

Earlier quoted context omitted.

There has also been a push by Google and others lately to "dumb down" the url bar to hide the full address from users. Not sure why but I assume the justification would be some misguided attempt at making it look nicer while the real reason is somehow ad related.

> There has also been a push by Google and others lately to "dumb down" the url bar to hide the full address from users. Not sure why but I assume the justification would be some misguided attempt at making it look nicer while the real reason is somehow ad related. Suggesting Google might do anything without ad-related motives is probably too generous, but I've always thought that this was an optimisation in the sens…

Safari has been doing this for years. The justification is partly because it makes the domain more obvious, especially on a mobile device where you have limited screen width. https://www.netflix.com.evilcorp.com would simply show up as evilcorp.com if only the domain is shown.

Re: The short tale of an online scam

#80

Post by throaway3141593 »

horsawlarway wrote: post #31
JadeNB wrote: post #27

Earlier quoted context omitted.

> There has also been a push by Google and others lately to "dumb down" the url bar to hide the full address from users. Not sure why but I assume the justification would be some misguided attempt at making it look nicer while the real reason is somehow ad related. Suggesting Google might do anything without ad-related motives is probably too generous, but I've always thought that this was an optimisation in the sens…

I think the reason was mostly AMP. Hiding/obscuring details from the URL bar seems like much less of a big deal if the goal is to rehost someone else's content. The value statement of the URL goes down a lot in that case, and the push to drive users away from it starts to make sense. Either which way, I still hate it - The only non-work related ticket I've put in for chromium was a request for an option to disable th…

> I think the reason was mostly AMP.

Safari on both mobile and desktop started doing this years before AMP was a thing.

Post reply on HN