71–80 of 83 posts
Earlier quoted context omitted.
Maybe it's a cultural thing? I've never come across a situation where anyone would give their CC number for a free service. That gives a really shady impression. Or expose myself to that risk.
Free service that requires a credit card? That is almost always a red flag for me and just screams “scam”. Who falls for that?
Earlier quoted context omitted.
Maybe it's a cultural thing? I've never come across a situation where anyone would give their CC number for a free service. That gives a really shady impression. Or expose myself to that risk.
Free service that requires a credit card? That is almost always a red flag for me and just screams “scam”. Who falls for that?
I'm an engineer (mostly web) and I am very tech savvy, and extremely wary on the internet of scams. However, if this site had to come me via a trusted channel, I would have fallen for it maybe 80% of the time. I hardly ever login to steam as it's always running and while I have 2FA my password would have been stolen in this attack for sure. I don't think teenagers and non-techy users would stand a chance against this…
Non-techy users don’t really stand a chance against anything, especially when you consider the attackers only need to get .1% for meaningful results.
Earlier quoted context omitted.
Free service that requires a credit card? That is almost always a red flag for me and just screams “scam”. Who falls for that?
Heroku, HBO, Discord, Amazon Prime, etc all have free trials/plans that require a credit card . . .
Wouldn't ever sign up for any of the others though.
And when a free trial requires a cc that kind of implies that you have to read the fine print very carefully and actively cancel before you get "upgraded".
Doesn't exactly inspire trustworthiness, I'd research competitors closely before considering a company that does that.
This is hard to defend against, but changing the default colour scheme (also used for every window title bar) helps somewhat.
Currently I'm on a tiling manager, and the "window decoration" is a three-pixel thick blue line, which even if you draw it in the middle of a web page is still wrong, because your supposed new window didn't tile correctly.
On those rare occasions where someone gets through the various NoScript-type protections I tend to run, it's amusing to see a Windows screen pop up. Yes, sir, I'll get right on running Windows Update on my Ubuntu system. (Do I have to install Wine for that, or...?) I've also seen some Windows-styled screens pop up on my Android browser on occasion... yeah... not terribly convincing there guys.
Earlier quoted context omitted.
What risk? That you have to wait a few days for your bank to send you a new card if it is compromised? There is no accidental charge risk as you then just call the bank and have them remove it. If your bank makes that difficult then switch to a reputable one.
I hate that kind reasoning. 1. You are actively funding thieves. This is wrong on so many levels it is bizarre. 2. All subscriptions need to be redone. 3. Even in a perfect world it is quite the hassle. And that is not taking into account the added problems if this were to be happening while you were on vacation. Even risking only one of those is a complete dealbreaker.
The site's dead now - the DNS record was pulled about an hour ago. But, I got a snapshot of the site and all the code before it got taken down, and I took the liberty of deobfuscating the big blobs of code: https://github.com/nneonneo/steam-phishing-analysis It's fairly simple code, in the end. The phishers copied the legitimate trading site, as well as the Steam Community login page, and then added some JavaScript c…
AFAIK that tool includes a very similar anti-debugging technique.
[1] https://github.com/javascript-obfuscator/javascript-obfuscat...
Earlier quoted context omitted.
> half way competent institution At which attackers shift their targets from a bank to a mobile phone provider... :(
Obligatory "SMS 2FA needs to stop" comment. Because it does.
I'm an engineer (mostly web) and I am very tech savvy, and extremely wary on the internet of scams. However, if this site had to come me via a trusted channel, I would have fallen for it maybe 80% of the time. I hardly ever login to steam as it's always running and while I have 2FA my password would have been stolen in this attack for sure. I don't think teenagers and non-techy users would stand a chance against this…
Note that LastPass didn't autofill the password and the box stayed gray instead of red. That would tip off most LastPass users that the url was wrong. edit: Image in question: https://i.imgur.com/hVTEKfD.png