Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Want to piss off your IT department? Are the links not malicious looking enough?

phishyurl.com

Post reply on HN
Print view View original

231–240 of 335 posts

Re: Want to piss off your IT department? Are the links not malicious looking enough?

#231

Post by raisaguys »

StopDisinfo910 wrote: post #220
siva7 wrote: post #167

Earlier quoted context omitted.

PSD2 is just MFA, it doesn't prevent shady companies still asking your login credentials, even if you must authorize that login from your official banking app. Klarna is one of many examples - they ask me for my bank credentials on their own website so they can crawl all my finance data .

I have a Klarna account I opened when their flex account rate was amongst the best you could get and I don't remember them ever asking for my bank credential. I think Bankin' used to before PSD2 and to get a bit more information from some banks but then again Bankin' is a financial agreggator whose explicit purpose is crawling your banking data so it's not too surprising to see them asking for your credentials.

[dead]

Re: Want to piss off your IT department? Are the links not malicious looking enough?

#232

Post by arghwhat »

Thorrez wrote: post #226
milkshakes wrote: post #191

Earlier quoted context omitted.

what percentage of the online population do you expect to understand this?

Yeah, it does make things more difficult in terms of teaching people a simple rule. Instead of "ends with @ .com", the rule is "ends with @ .com or . ". OTOH, there were probably a lot of places already violating the "ends with @ .com" rule, e.g. by using subdomains, or even other domains. So very little of the online population was likely using the rule. And with email spoofing, even "ends with @ .com" can't be reli…

Yay for third-party email services that From: be a no-reply address from an entirely different company (and therefore only authenticity validation for that company), and a Reply-To: to some obscure mailbox from the supposed sender. I'm sure that makes perfect sense to most people.

> So the rule of "don't click links in emails" is the only foolproof rule.

The only truly foolproof rule is "don't open emails". Also helps a lot on mental health and associated expenditures!

Re: Want to piss off your IT department? Are the links not malicious looking enough?

#234

Post by btbuildem »

arghwhat wrote: post #149

Ah no need, corporate IT already make all URLs malicious looking through some microsoft "secure link" service, and constantly shows everyone shady looking prompts that constantly change and have cmd.exe windows flash in at random. A phone call from Microsoft about my Norton anti-virus subscription putting me into debt that can only be settled with Nintendo gift cards bought in cash across 16 specific gas stations see…

My little hobby is reporting any and all emails about compliance, training, etc (basically anything with actions in them) as phishing and then escalating their responses as "social engineering". It's fun!

Re: Want to piss off your IT department? Are the links not malicious looking enough?

#235

Post by arghwhat »

Thorrez wrote: post #227
greengreengrass wrote: post #225

Earlier quoted context omitted.

I have often wondered why we don’t see more usage of the brand gTLDs, which many of these big firms own. I muse that this is (part of) the reason why – there simply isn’t the understanding or recognition outside tech circles (or even within tech circles) to comprehend that it is possible to use such a gTLD without a conventional .com or similar suffix tacked on the end. I tend to see it localised to use for marketing…

I don't think you can put cookies on a TLD. So if Google used mail.google and calendar.google , the login system would be more complex, because they can't share cookies.

Modern auth systems do not work by exposing multiple services on a single domain with shared cookies.

Instead, they authenticate using a common auth service (say, auth.google), which by virtue of being a single domain can persist shared cookies for all its consumers. This would yield a valid token (possibly a JWT) that the authenticating application can then use however it would like, including as a cookie on the application's own domain.

Whenever you go to a service that temporarily sends you to a different login domain (often just immediately redirection you back), this is why.

Re: Want to piss off your IT department? Are the links not malicious looking enough?

#236

Post by bigfishrunning »

isoprophlex wrote: post #80
varenc wrote: post #45

I registered the "very-secure-no-viruses.email" domain to use for burner emails. I was trying to make one that sounded maximally sketchy. It has lead to some confusing interactions with support though...

I have firstname@lastname.email... people keep telling me that can't be right and don't i mean it ends with email.com?

i have a .dev domain and i get the same thing all the time

Re: Want to piss off your IT department? Are the links not malicious looking enough?

#237

Post by Workaccount2 »

cedilla wrote: post #152
arghwhat wrote: post #149

Ah no need, corporate IT already make all URLs malicious looking through some microsoft "secure link" service, and constantly shows everyone shady looking prompts that constantly change and have cmd.exe windows flash in at random. A phone call from Microsoft about my Norton anti-virus subscription putting me into debt that can only be settled with Nintendo gift cards bought in cash across 16 specific gas stations see…

All that anti-phishing training that taught us to look closely at the URL and now it's all just safelinks.protection.outlook.com

My It department does mandatory phishing training every year, and then for the "test" e-mails, they spoof a domain and whitelist the DMARC on their side so it goes through.

So we get e-mails from @microsoft.com and it's only if you dig in the metadata that you see it failed authentication. The only tell in the e-mail is checking the URL, which doesn't tell you much because tons of regular e-mails use tracker redirects too. They even send emails from our own domain or the domain of our payroll company.

I won't type out my rant, but our IT department is a few guys who couldn't figure out what to do when their competitive xbox FIFA 2006 dreams failed, heard IT pays a lot with not much work, and then sat through the certs.

Re: Want to piss off your IT department? Are the links not malicious looking enough?

#238

Post by bigfishrunning »

engrefoobiz wrote: post #128
isoprophlex wrote: post #80

Earlier quoted context omitted.

I have firstname@lastname.email... people keep telling me that can't be right and don't i mean it ends with email.com?

I have a .ninja email and get the same a lot to the extend where I explicitly say "it ends in .ninja with no .com or anything". Usually use company-i-buy-from@mydomain.ninja whenever I make online purchases, and I had a guy from a small shop call me up and ask why I had an email with his company name on. Took some good fifteen minutes to explain him that I was legit and owned the domain. He was still reluctant in the…

I used to use this company-i-buy-from strategy, but i got accused of fakery a lot, until I tried a new strategy -- interest@domain.dev. So if i were buying from REI, i would use camping@domain.dev or if i were ordering office supplies i would use officemgmt@domain.dev. It's slightly less obvious what you're doing, and raises fewer questions.

Re: Want to piss off your IT department? Are the links not malicious looking enough?

#239

Post by bigfishrunning »

deadbabe wrote: post #41
Aeolun wrote: post #18

Earlier quoted context omitted.

I think the lesson here is that any link in an email is bad. We should just block all of them.

Come on man, don’t be so uptight. We can’t just be 100% max security all the time or no one will want to do business. A little bit of risk for clicking a link is worth the convenience.

Sounds like something a scammer would say...

Re: Want to piss off your IT department? Are the links not malicious looking enough?

#240

Post by stronglikedan »

Workaccount2 wrote: post #237
cedilla wrote: post #152

Earlier quoted context omitted.

All that anti-phishing training that taught us to look closely at the URL and now it's all just safelinks.protection.outlook.com

My It department does mandatory phishing training every year, and then for the "test" e-mails, they spoof a domain and whitelist the DMARC on their side so it goes through. So we get e-mails from @microsoft.com and it's only if you dig in the metadata that you see it failed authentication. The only tell in the e-mail is checking the URL, which doesn't tell you much because tons of regular e-mails use tracker redirect…

> heard IT pays a lot with not much work

I want to live in this fantasy world!

(Our IT dept is so overworked that I go out of my way to work around them purely out of empathy.)

Post reply on HN