Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Kurt Got Got

fly.io

Post reply on HN
Print view View original

231–240 of 256 posts

Re: Kurt Got Got

#231

Post by pixl97 »

taneq wrote: post #161
liquidgecka wrote: post #124

Earlier quoted context omitted.

My former company would send out rewards as a thank you to employees. It was basically a “click here to receive your free gift!” email. I kept telling the security team that this was a TERRIBLE president but it continued none the less. The first time I got one I didn’t open it for ages, even after confirming the company was real. It was only after like the 5th nagging email that I asked security about it and they con…

There are SO MANY terrible practices like this carried out by companies big enough to know better. From registering new domains for email addresses (for a while a BigCorp customer of ours had a mix of @bigcorp.com and @bigcorp2.com email addresses, how the hell is any user meant to guess that MediumCorp hasn't also spun up a mediumcorp2.com mail server?!) to FedEx sending "click this link to pay import duties" texts…

>mix of @bigcorp.com and @bigcorp2.com

This pisses me off when the company I work for as a website for the new application for the week. I couldn't even begin to tell you how many websites we have. They don't have a list of them anywhere.

Re: Kurt Got Got

#232

Post by dogleash »

skeeter2020 wrote: post #195
Aeolun wrote: post #116

Earlier quoted context omitted.

Our company does regular phishing attacks against our own team, which apparently gets us a noteworthy 90% ‘not-click’ rate (don’t quote me on numbers). Never mind that that 10% is still 1500 people xD It’s gone so far that they’re now sending them from our internal domains, so when the banner to warn me it was an external email wasn’t there, I also got got.

>> so when the banner to warn me it was an external email These are so obviously useless. When the majority of your email has a warning banner it stops to be any sort of warning. It's like being at "code orange" for 20 years after 9/11; no-one maintained "heightened security awareness" for decades, it just became something else to filter.

> When the majority of your email has a warning banner it stops to be any sort of warning.

All they've done is teach me to spot the phishing tests, because our email is configured to let the test bypass the banner.

Re: Kurt Got Got

#233

Post by pixl97 »

chrismorgan wrote: post #138
kalleboo wrote: post #123

Earlier quoted context omitted.

It's far too common for websites to redirect to some separate domain for sign in which isn't the one originally used to sign up, getting users used to "oh gotta copy the password again" as a totally normal thing that happens

I keep hearing people say this, but I haven’t found it so: in over a decade, I think I’ve only seen it twice . Looking through my password safe which I’ve been using for about twelve years with over 200 entries, I have nine cases with multiple origin URLs, and most of them I’m confident I added manually because I didn’t like the URL it recorded automatically (e.g. it’s on a different domain from the main site, and th…

While you kind of addressed it below, I'm not sure you know how bad state government websites can be here in the US.

In Texas I've had more than one site where create the login on one site, but use that same login on multiple different domains that are NOT directly connected to a singular authentication site (id.me in the example).

Re: Kurt Got Got

#234

Post by pixl97 »

toast0 wrote: post #130
smsm42 wrote: post #88

Earlier quoted context omitted.

Unfortunately, this does not work. I see no end of banks, financial institutions, let alone random companies, who keep their authentication, for some reason, on different domain than main company, and sometimes they would have initial registration (which gets recorded in password manager) on one domain, and consequent logins on another, and sometimes it depends on how you arrived at the site, or which integration are…

> Would you check the certificate for each link going there, and trace it down, or just assume Citi is up to their shenanigans again and paste the password manually? What do you get from checking a certificate? Oh yeah, must really be citibank because they have a shitton of SANs? I'd guess most banks do have a cert with an organization name, but organization names can be misleading, and some banks might use LetsEncry…

Org certs have pretty much fallen out of favor these days.

Re: Kurt Got Got

#235

Post by 0xdeadbeefbabe »

tptacek wrote: post #222
0xdeadbeefbabe wrote: post #221

Huh, so I'm stupid I guess, but how is MFA phish proof? Why did Kurt's commit access get revoked?

The commit access thing is a joke. I think it's a joke. It's mostly a joke. MFA is not in general phish-resistant. But Passkeys, U2F, and FIDO2 generally are, because they mutually authenticate; they're not just "one time passwords" you type into a field, but rather a cryptographic protocol running between you and the site.

Well he must be punished somehow!

Re: Kurt Got Got

#236

Post by pixl97 »

pants2 wrote: post #49

This "content violation on your X post" phishing email is so common, we get about a dozen of those a week, and had to change the filters many times to catch them (because it's not easy to just detect the letter X and they keep changing the wording). We also ended up dropping our email security provider because they consistently missed these. We evaluated/trialed almost a dozen different providers and finally found on…

It easy to block all phishing email. Just block all email.

It's much much harder to block emails that aren't actually phishing but have components that would flag them anyway.

Re: Kurt Got Got

#237

Post by pas »

eru wrote: post #171
mr_mitm wrote: post #166

Earlier quoted context omitted.

I don't think we should be calling the users idiots when we failed to make our systems secure by design. If a simple act like plugging in a thumb drive by a well-meaning user undermines the security of an entire operation, then why do we allow such a thing to happen? Relevant: https://www.schneier.com/blog/archives/2016/10/security_desi...

Yes. People used to laugh at the auto-play for CD-ROMs in Windows 95. But if a USB device can hijack your system, is it that different?

Are we still at the "Bill Gates got a BSoD during the demo of USB" level?

I know that at least on Linux mounting filesystems can lead to nasty things, so there's FUSE, but ... I have no idea what distros and desktop environments do by default. And then there's all the preview/thumbnail generators and metadata parsers, ...

Re: Kurt Got Got

#238

Post by siskiyou »

tptacek wrote: post #198
siskiyou wrote: post #181

The part I found surprising: 'Twitter fell outside the “things we take seriously” boundary' Sure Twitter is rubbish, but it's still a huge platform, still tied to your brand, you're still using it, so it can still hurt you. Either take it seriously or stop using it.

Before the Twitter Change of Control, we were actively using it. After, it fell into a kind of limbo. There was a solid 6 months or so when we thought maybe we were just going to do everything via our Hachyderm account. Shit's complicated. And if we'd stopped using it altogether, we'd still be in the same boat!

Thanks for your answer. I get it, you're people, it's a mistake, it's not the most horrible thing ever, but a simple "oops my bad" would have been a shorter blog post. Would you really have been in the same boat if the tweet shown mentioned in the phishing effort had never been posted, or did the phisher fabricate that entirely?

Re: Kurt Got Got

#239

Post by siskiyou »

loloquwowndueo wrote: post #193
siskiyou wrote: post #181

The part I found surprising: 'Twitter fell outside the “things we take seriously” boundary' Sure Twitter is rubbish, but it's still a huge platform, still tied to your brand, you're still using it, so it can still hurt you. Either take it seriously or stop using it.

You mean X, right? Sounds like neither them nor you take it seriously :)

(Turning up my hearing aids) that's right mate

Re: Kurt Got Got

#240

Post by BobaFloutist »

JdeBP wrote: post #224
tsimionescu wrote: post #184

Earlier quoted context omitted.

Which systems ask before allowing you to use a keyboard you just plugged in over USB? Windows, Ubuntu, Fedora certainly don't, at least not by default.

Mine. Not asking whoever happens to have local physical access interactively , strictly speaking, as that just papers over one of the problems; but controlling what Human Input Devices are allowed when plugged in, by applying rules (keyable on various device parameters) set up by the administrator. Working thus far on NetBSD, FreeBSD, and Linux. OpenBSD to come when I can actually get it to successfully install on th…

Assuming the OS isn't running on a laptop, how do you approve the first keyboard or mouse you plug in?
Post reply on HN