Wide Impact: Highly Effective Gmail Phishing Technique Being Exploited
1–10 of 49 posts
Re: Wide Impact: Highly Effective Gmail Phishing Technique Being Exploited
#2[deleted]
Re: Wide Impact: Highly Effective Gmail Phishing Technique Being Exploited
#3Are any advanced users on HN that would've overlooked the obvious signs in the address bar?
I mean, you don't have to know what the string 'data:text/html' means, because Google Chrome highlights the 'https' by coloring it green and they even show a 'secure' button right next to it, so the whole area looks fundamentally different.
IMHO only inexperienced users will fall for this. If you regularly look at the address bar before entering critical data into a website, you will get used to the overall look and most likely notice that something is out of order.
Re: Wide Impact: Highly Effective Gmail Phishing Technique Being Exploited
#4Are there legitimate use cases for 'data:...' URIs as clickable links? I understand these URIs can be useful for embedding resources directly into the HTML, e.g. images and icons. But as clickable links, I have only ever encountered them as a means to circumvent popup-blockers. Would it be reasonable for web browsers to offer an option for ignoring clicks on such links?
Re: Wide Impact: Highly Effective Gmail Phishing Technique Being Exploited
#5Are any advanced users on HN that would've overlooked the obvious signs in the address bar? I mean, you don't have to know what the string 'data:text/html' means, because Google Chrome highlights the 'https' by coloring it green and they even show a 'secure' button right next to it, so the whole area looks fundamentally different. IMHO only inexperienced users will fall for this. If you regularly look at the address…
I recently switched from Chrome to Firefox, and might have fallen for it since I'm not used to the address bar.
Heck, sometimes browsers come with an update that changes it's appearance.
Re: Wide Impact: Highly Effective Gmail Phishing Technique Being Exploited
#6I think most "technical" users would have two-factor authentication enabled which would prevent this type of attack.
Re: Wide Impact: Highly Effective Gmail Phishing Technique Being Exploited
#7I think most "technical" users would have two-factor authentication enabled which would prevent this type of attack.
> [...] which would prevent this type of attack.
Depends. See the discussion in the previous post about this: https://news.ycombinator.com/item?id=13372985
Re: Wide Impact: Highly Effective Gmail Phishing Technique Being Exploited
#8I think most "technical" users would have two-factor authentication enabled which would prevent this type of attack.
No - because the phishing page can act as a MITM attack - where they display the 2-factor login on the phishing page - and post the entered code to Google, confirm they are in (and receive the cookie enabling access) - while displaying the page back to you.
So 2-factor actually provides a false sense of security here.
Edit: unless you have U2F as per @makomk comment below
Re: Wide Impact: Highly Effective Gmail Phishing Technique Being Exploited
#9I agree with the article's suggestion[0] that 'data:text/HTML' should be changed to amber (or even red)... How often would a non-technical user need to access such a URI? Technical users (the same way they may test insecure sites), would be savvy to this for legitimate means.
This is pretty much a win-win Chrome hot-fix that could be rolled out asap.
What an excellent analysis of the user perception involved and its obvious remedy.
[0] > What Google needs to do in this case is change the way ‘data:text/html’ is displayed in the browser. There may be scenarios where this is safe, so they could use an amber color with a unique icon. That would alert our perception to a difference and we would examine it more closely.
Re: Wide Impact: Highly Effective Gmail Phishing Technique Being Exploited
#10Are there legitimate use cases for 'data:...' URIs as clickable links? I understand these URIs can be useful for embedding resources directly into the HTML, e.g. images and icons. But as clickable links, I have only ever encountered them as a means to circumvent popup-blockers. Would it be reasonable for web browsers to offer an option for ignoring clicks on such links?
I think they're also sometimes used to strip the referrer from links.