71–79 of 79 posts
Earlier quoted context omitted.
>not to mention asking people to install random third party software just to use their websites because browsers apparently aren't good enough. is this still a thing? maybe this was true back in the days when activeX was still common, but not now.
Check out Rapport, big banks prompt you to install it everytime you visit their login page.
The many mobile browsers which hide the address bar are training people to ignore website urls. Sites who use lots of nonsensical malware-ish url redirects (Google, Microsoft are guilty) train people to accept random urls. I guess the chief culprits are email tracking links. Everyone including banks use them. Often tracking domains have nothing in common with the destination URL. This teaches people to disable or ign…
> email tracking links ... domains have nothing in common with the destination URL The tradeoff has been CNAME-ing your own subdomain to your Email Service Provider’s tracking domain, which gets you a recognizable(-ish) URL, but has historically prevented https links, or using the ESP’s tracking domain directly, which allows https but makes sketchy-looking URLs. I’d think Let’s Encrypt would make it possible to offer…
Technically, Let's Encrypt is not unique here. AFAIK, most CAs allow subdomain certs (and only validate ownership of said subdomain, not the top-level domain).
Let's Encrypt just makes it scalable financially.
Users are not discerning enough to look for the padlock; they'll get taken either way. They are not the problem here. The bigger problem with this is that the paths being requested can't be monitored by intermediary devices unless you're MITMing all outbound traffic. It becomes impossible to tell whether a domain is simply cybersquatting or if they're up to something more sinister. '/' may return a parking page, '/lo…
I think it’s still a worthwhile trade off. The percentage of people using network inspection for “good” like malware/phishing filtering is much lower than the percentage using it for bad stuff like ad/cancer tracking.
Earlier quoted context omitted.
I'm pretty sure that's actually impossible. If someone registers a domain and cert that's essentially a homoglyph attack against a common website, you're basically stuck with heuristics to detect it. You need a global database of targetable domains that supports similarity checking with arbitrary Unicode. You need some kind of fuzzy hash of the website to see whether the website your user is looking at is actually an…
Whatever happened to the Web of Trust thing? We could have a curated one so that an extension can indicate: - whether the domain is substantially similar to a trusted one - recent data breaches - whether the site has been known to sell data Those could be indicated by different, intuitive colors: - red - high likelihood of phishing/malware - yellow - recent data breach; user intervention required, but the service its…
To answer your question, privacy addons started selling our data. I remember Adblock Plus added "Acceptable Ads" around 2012. MyWot redesigned in 2013. Times were changing. Surely enough in 2016 they were found selling sensitive user data. It's not like this was a surprise, since it's the reason I left years ago.
These days, I'd rather reduce my browser dependency. I hope the community finds a way to filter the 1% of useful data on the internet into like a .txt file, or something that doesn't make me solve puzzles to grep.
Earlier quoted context omitted.
I think it’s still a worthwhile trade off. The percentage of people using network inspection for “good” like malware/phishing filtering is much lower than the percentage using it for bad stuff like ad/cancer tracking.
Still, I wish it was easier for me to locally MITM a single application running on my computer/phone. I find myself wanting to do this roughly every month.
I thought this was the point of EV certs.
Earlier quoted context omitted.
Relying on users manually confirming that the domain is correct has never been a good strategy. The user is supposed to tell microsoft.com from micros0ft.com from microsoft.co from microsoft-corp.com?
I recently saw a MacKeeper landing page url: "www.apple.com-spamsite.info/landing" It was truncated in the url-bar enough to look like "www.apple.com". The landing page, of course, was a clone of the apple.com website with a "Scan Computer" button that did the ol trick of showing you some animations before suggesting you use MacKeeper to clean up 17 viruses.