Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Half of All Phishing Sites Now Have the Padlock

krebsonsecurity.com

Post reply on HN
Print view View original

11–20 of 79 posts

Re: Half of All Phishing Sites Now Have the Padlock

#11

Post by jstarfish »

Users are not discerning enough to look for the padlock; they'll get taken either way. They are not the problem here.

The bigger problem with this is that the paths being requested can't be monitored by intermediary devices unless you're MITMing all outbound traffic.

It becomes impossible to tell whether a domain is simply cybersquatting or if they're up to something more sinister. '/' may return a parking page, '/login' may return a phishing page, and '/?id=c4010087800cf4e5753c80c9afbe0fe5' may be a malware callback, but as far as you can tell from your network logs all traffic to httpx://www.xn--bbox-vw5a.com is simply requesting '/'.

Re: Half of All Phishing Sites Now Have the Padlock

#12

Post by [deleted] »

medmunds wrote: post #6
vezycash wrote: post #2

The many mobile browsers which hide the address bar are training people to ignore website urls. Sites who use lots of nonsensical malware-ish url redirects (Google, Microsoft are guilty) train people to accept random urls. I guess the chief culprits are email tracking links. Everyone including banks use them. Often tracking domains have nothing in common with the destination URL. This teaches people to disable or ign…

> email tracking links ... domains have nothing in common with the destination URL The tradeoff has been CNAME-ing your own subdomain to your Email Service Provider’s tracking domain, which gets you a recognizable(-ish) URL, but has historically prevented https links, or using the ESP’s tracking domain directly, which allows https but makes sketchy-looking URLs. I’d think Let’s Encrypt would make it possible to offer…

[deleted]

Re: Half of All Phishing Sites Now Have the Padlock

#13

Post by paraditedc »

jstarfish wrote: post #7
vezycash wrote: post #2

The many mobile browsers which hide the address bar are training people to ignore website urls. Sites who use lots of nonsensical malware-ish url redirects (Google, Microsoft are guilty) train people to accept random urls. I guess the chief culprits are email tracking links. Everyone including banks use them. Often tracking domains have nothing in common with the destination URL. This teaches people to disable or ign…

> The many mobile browsers which hide the address bar are training people to ignore website urls. This is my biggest complaint about forcing users to use apps to browse a website-- it hides everything . I have no idea if any given app is actually using SSL. Oversights have happened before to Credit Karma, Fandango and others.

On the positive side, with apps, there's a lower chance to land on a phishing app, because apps need to be reviewed before they appear on the store.

Re: Half of All Phishing Sites Now Have the Padlock

#14

Post by saurik »

jstarfish wrote: post #7
vezycash wrote: post #2

The many mobile browsers which hide the address bar are training people to ignore website urls. Sites who use lots of nonsensical malware-ish url redirects (Google, Microsoft are guilty) train people to accept random urls. I guess the chief culprits are email tracking links. Everyone including banks use them. Often tracking domains have nothing in common with the destination URL. This teaches people to disable or ign…

> The many mobile browsers which hide the address bar are training people to ignore website urls. This is my biggest complaint about forcing users to use apps to browse a website-- it hides everything . I have no idea if any given app is actually using SSL. Oversights have happened before to Credit Karma, Fandango and others.

https://techcrunch.com/2016/06/14/apple-will-require-https-c...

Re: Half of All Phishing Sites Now Have the Padlock

#15

Post by smallbigfish »

hanoz wrote: post #5
vezycash wrote: post #2

The many mobile browsers which hide the address bar are training people to ignore website urls. Sites who use lots of nonsensical malware-ish url redirects (Google, Microsoft are guilty) train people to accept random urls. I guess the chief culprits are email tracking links. Everyone including banks use them. Often tracking domains have nothing in common with the destination URL. This teaches people to disable or ign…

Banks and credit card companies have always been the absolute worst offenders for this, requiring people to use hidden iframes from all sorts of acmegenericsecure.net domains, and all the while professing to be the high priests of good practice with their absurd PCI racket, not to mention asking people to install random third party software just to use their websites because browsers apparently aren't good enough.

Just last year I told Ikea that they use a phishing like url in my country. Something like makeyourhomegreat.com (I can't remember the exact URL). They actually stopped using that URL but I'm not sure it was because of me or some other reason.

Re: Half of All Phishing Sites Now Have the Padlock

#17

Post by penagwin »

paraditedc wrote: post #13
jstarfish wrote: post #7

Earlier quoted context omitted.

> The many mobile browsers which hide the address bar are training people to ignore website urls. This is my biggest complaint about forcing users to use apps to browse a website-- it hides everything . I have no idea if any given app is actually using SSL. Oversights have happened before to Credit Karma, Fandango and others.

On the positive side, with apps, there's a lower chance to land on a phishing app, because apps need to be reviewed before they appear on the store.

RIP Microsoft. IMO this is a big reason why their phones/app store died. Try finding the real VLC player in the store - last I checked they dont even have a app store version (but you'll find tons of results for it).

Re: Half of All Phishing Sites Now Have the Padlock

#18

Post by sandov »

Noob question, if a.com gets a certificate, then b.a.com can use the same cert, right? As in the example of the fb impostor in 000webhost.

So, in that same vein, can a TLD get a certificate? For example, com gets a certificate, so now anything.com has a valid certificate. Also, can I issue a cert specifically for d.c.b.a.com?

Re: Half of All Phishing Sites Now Have the Padlock

#20

Post by dbdjfjrjvebd »

sandov wrote: post #18

Noob question, if a.com gets a certificate, then b.a.com can use the same cert, right? As in the example of the fb impostor in 000webhost. So, in that same vein, can a TLD get a certificate? For example, com gets a certificate, so now anything.com has a valid certificate. Also, can I issue a cert specifically for d.c.b.a.com?

In short no.

a.com does not match b.a.com

Only if the certificate is *.a.com does it match b.a.com

b.a.com can have its own certificate.

Post reply on HN