221–230 of 335 posts
Earlier quoted context omitted.
There's no legitimate case for that since PSD2 (mandatory since 2020). Are you not confused by that? PSD2 doesn't share your credentials. I'm an European and have never needed to use nor encountered those services.
Where a bank doesn't offer compliant APIs, screen-scraping integrations are explicitly allowed. Not sure how common that is at this point.
Real evil would be a kind of reverse-psychology: 1. Make a site like this. 2. Wait for people to try it out with an URL that goes to a significant site (bank, social media, email, etc.) 3. Allow a bit of normal use, then secretly switch the link so that further visitors land on a corresponding phishing site. 4. Having just dismissed a bunch of "obviously fake" warning signs, people may be less alert when real ones ar…
Im sure in tge nect 5 years a blackhat model will exist that clone any website into a phishing site.
Earlier quoted context omitted.
I have a .ninja email and get the same a lot to the extend where I explicitly say "it ends in .ninja with no .com or anything". Usually use company-i-buy-from@mydomain.ninja whenever I make online purchases, and I had a guy from a small shop call me up and ask why I had an email with his company name on. Took some good fifteen minutes to explain him that I was legit and owned the domain. He was still reluctant in the…
Ha! Exactly this happens to me too. Had to return some electronics in person, the guy suddenly started fishing if I was some mystery shopper or QC person... because the invoice was made out to their.store@myname.email That said I've caught and blacklisted quite a few bad actors this way, AND filtering is easier. So worth the occasional weird interaction.
I did this for a decade and decided it was't worth it, nor the plus in gmail addresses.
It was a ton of effort remembering which address I used (I have multiple domains, too, oh joy).
I would end up with multiple accounts on websites, and support calls were super painful.
Eventually I switched providers and realized that in all that time I literally never found any "smoking gun" of a company selling my info.
And the plus email addresses were super useless because spammers know they can just strip out the bit after the plus. Duh.
In fact, my "real" email address that kept super secret and never ever ever gave to anyone except real in-the-flesh human friends (and thus never got any real email to, lol) was by far and away the most compromised email address. Stratospherically compromised.
Around 2001 I worked for one of the big dot com news outlets. In our reception we had a PC with a browser set up where people could "use the internet" while they waited. One day the receptionist asked me to fix the PC as it wasn't connected to the internet and no one from IT was available. So I messed around a bit (think in the end I just reset the DCHP lease) and to test I opened the browser to surf the net. Of cour…
Lol, in that situation, the best combination would have been Win+D, I guess.
Earlier quoted context omitted.
Well it's probably hard for anyone except Microsoft to get a domain with the .microsoft TLD.
what percentage of the online population do you expect to understand this?
The other reason I hypothesise is that corporate big brother snooping systems that have whitelists for their trusted services – with entries like mail.google.com or calendar.google.com – are simply too painful at this point for big tech to break for their customers by dropping the .com suffix, so big tech doesn’t bother.
No hard data on any of that, though.
Earlier quoted context omitted.
Well it's probably hard for anyone except Microsoft to get a domain with the .microsoft TLD.
what percentage of the online population do you expect to understand this?
OTOH, there were probably a lot of places already violating the "ends with @.com" rule, e.g. by using subdomains, or even other domains. So very little of the online population was likely using the rule. And with email spoofing, even "ends with @.com" can't be relied on to ensure the email is legit. So the rule of "don't click links in emails" is the only foolproof rule. Though you also need to add "don't copy and paste things from emails".
Earlier quoted context omitted.
what percentage of the online population do you expect to understand this?
I have often wondered why we don’t see more usage of the brand gTLDs, which many of these big firms own. I muse that this is (part of) the reason why – there simply isn’t the understanding or recognition outside tech circles (or even within tech circles) to comprehend that it is possible to use such a gTLD without a conventional .com or similar suffix tacked on the end. I tend to see it localised to use for marketing…
Earlier quoted context omitted.
I have a .ninja email and get the same a lot to the extend where I explicitly say "it ends in .ninja with no .com or anything". Usually use company-i-buy-from@mydomain.ninja whenever I make online purchases, and I had a guy from a small shop call me up and ask why I had an email with his company name on. Took some good fifteen minutes to explain him that I was legit and owned the domain. He was still reluctant in the…
Ha! Exactly this happens to me too. Had to return some electronics in person, the guy suddenly started fishing if I was some mystery shopper or QC person... because the invoice was made out to their.store@myname.email That said I've caught and blacklisted quite a few bad actors this way, AND filtering is easier. So worth the occasional weird interaction.
Ah no need, corporate IT already make all URLs malicious looking through some microsoft "secure link" service, and constantly shows everyone shady looking prompts that constantly change and have cmd.exe windows flash in at random. A phone call from Microsoft about my Norton anti-virus subscription putting me into debt that can only be settled with Nintendo gift cards bought in cash across 16 specific gas stations see…
I'm using Finicky[1] on Mac to rewrite the URL by extracting the original URL from the query params[2].
1: https://github.com/johnste/finicky
2: https://github.com/fphilipe/dotfiles/blob/31e3d18fe5f51b2fd8...