Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Launch HN: Riot (YC W20) – Phishing training for your team

news.ycombinator.com

Post reply on HN
Print view View original

71–80 of 93 posts

Re: Launch HN: Riot (YC W20) – Phishing training for your team

#71

Post by jedberg »

swamifin wrote: post #60
jedberg wrote: post #11

> Would love to hear your war stories on phishing scams, and how you train your teams! I was working on anti-phishing in 2003, before it had the name phishing. We were trying to teach our users not to fall for the scams. It didn't work. People will fall for the same scam over and over. The conclusion we came to was that the only solution to phishing was education, and education was also nearly impossible to get 100%…

If you wouldn't mind I'd really like to get your opinion on this proposed hardware solution I posted a while back: https://news.ycombinator.com/item?id=22343786

I'd have to think about it more, but if feels overly complex. You've essentially taken the idea of a DMZ network and put it in an individual computing device.

DMZ networks are hard to get right and hard to admin, and almost always end up getting some sort of exception for certain business needs.

Asking a user to admin that, or having no admin at all, feels almost impossible.

Re: Launch HN: Riot (YC W20) – Phishing training for your team

#72

Post by anitil »

closeparen wrote: post #61
nothrabannosir wrote: post #54

Earlier quoted context omitted.

> The conclusion we came to was that the only solution to phishing was education, and education was also nearly impossible to get 100% coverage. A friend works for a company that fires employees after failing three phishing tests. It doesn’t solve the problem for those people, but it does work for that company. What has priority depends on your management style :)

The only way to pass the phishing tests at my employer is to never click links in email . But then we also have a number of official systems sending emails with links in them (bug tracking, code review, Zoom invites, HR portal, etc). The only way this kind of policy makes sense is if you have to actually give the phishing site some kind of credential in order to fail, vs. merely opening on it. If someone has a Chrome…

This is my major concern. Heaps of legitimate companies send emails with links to things like 'http://dh380. party server>.com'. We're being trained to accept this sort of silliness

Re: Launch HN: Riot (YC W20) – Phishing training for your team

#73

Post by mike_d »

BenjaminN wrote: post #13
eggbrain wrote: post #10

How do you work with the service providers you use to host your platform and send out emails (e.g. Heroku / Mailgun) to let them know you are not a malicious phishing company, but an anti-phishing company? I say this because I ended up reporting the phishing email I received from you guys to Mailgun, and I believe accidentally got your account disabled. Sorry about that.

YES you did! I called them just right after that, and I have to say they've been great so far. We agreed I would pay for a dedicated IP, and they now fully support Riot. And having a dedicated IP is actually better, because you can now remove the unexpected warning on Gmail.

Your dedicated IP is going to get flagged as more and more users report it. I run phishing as part of red team exercises and have a constant need for new fresh IPs.

Re: Launch HN: Riot (YC W20) – Phishing training for your team

#74

Post by mike_d »

bearcobra wrote: post #46

My company uses Knowbe4, and I'm constantly frustrated how it considers it a fail if I only click a link vs entering in credentials. Sometimes it's tough to tell if something is phishing when your checking email on your phone. Does Riot work the same way? Or do you test to see if users notice issues once they've actually opened something in the browser?

> I'm constantly frustrated how it considers it a fail if I only click a link vs entering in credentials

That is a failure. There is currently a Windows font parsing vulnerability that is being exploited in the wild just like this. If you click the link, you are subjecting your browser and OS to an attacker crafted payload.

Re: Launch HN: Riot (YC W20) – Phishing training for your team

#76

Post by cyphar »

jujodi wrote: post #66
_xnmw wrote: post #64

Everyone's vulnerable to phishing, no matter how technically literate. It's too easy to click through an email during a moment of inattention. I've often thought that the only way to reliably prevent phishing is to enforce the use of a password manager browser extension, which will refuse to enter a saved password except on the original domain. Nobody should ever be manually typing passwords, or even copy-pasting pas…

For some reason I thought this was the pitch and I LOVE this idea. Is it possible for a password manager plugin to capture your "paste" and verify the window url? I know there's an onpaste clipboard event so sure seems like this would be possible.

Password managers that have browser integration already function this way -- you have to go out of your way to copy-paste your password. The main problem is that some sites design their login forms to make this kind of functionality harder (such as putting the password and username fields on different pages, or having strange layouts where you need to also input your last name, and so on).

I personally use KeepassXC which has a browser plugin that does this for you (and it's nice that the plugin doesn't have access to your passwords directly -- it has to request access from the password manager which be default gives you a popup asking for permission to share specific credentials).

Re: Launch HN: Riot (YC W20) – Phishing training for your team

#77

Post by ackbar03 »

eggbrain wrote: post #10

How do you work with the service providers you use to host your platform and send out emails (e.g. Heroku / Mailgun) to let them know you are not a malicious phishing company, but an anti-phishing company? I say this because I ended up reporting the phishing email I received from you guys to Mailgun, and I believe accidentally got your account disabled. Sorry about that.

If you reported their email you probably passed the test anyways

Re: Launch HN: Riot (YC W20) – Phishing training for your team

#78

Post by closeparen »

anitil wrote: post #72
closeparen wrote: post #61

Earlier quoted context omitted.

The only way to pass the phishing tests at my employer is to never click links in email . But then we also have a number of official systems sending emails with links in them (bug tracking, code review, Zoom invites, HR portal, etc). The only way this kind of policy makes sense is if you have to actually give the phishing site some kind of credential in order to fail, vs. merely opening on it. If someone has a Chrome…

This is my major concern. Heaps of legitimate companies send emails with links to things like ' http://dh380. party server>.com'. We're being trained to accept this sort of silliness

I don't think it's realistic to live in constant fear of browser sandbox escapes, or to consider visiting an arbitrary URL "silliness." If your threat model includes people willing to burn Chrome 0-days on you, you need an air gap.

The much more relevant battle is preventing credential theft, which you can solve completely at the technical level with U2F. And if you can't, user education on "check the URL before typing your password" is a little more realistic than "don't open links from email ever."

Re: Launch HN: Riot (YC W20) – Phishing training for your team

#79

Post by pipework »

BenjaminN wrote: post #18
equidistant wrote: post #16

Earlier quoted context omitted.

It's bad in that there's already a very popular game company named Riot (Games) which everyone refers to as 'Riot'.

Some people know League of Legends, most don't know Riot Games. And I double checked: Riot Games don't own a trademark for anything related to cybersecurity.

Way more people already know riot games and league of legends than will ever know about your security startup, so I don't see what they're upset about for you. Hand-wringing, perhaps?
Post reply on HN