3 ms·

Wow, I don't like this. My usual tactic of looking for the / after the .tld isn't a general solution anymore. I hope my bank doesn't implement this functional

Wow, I don't like this. My usual tactic of looking for the / after the .tld isn't a general solution anymore. I hope my bank doesn't implement this functionality.

Phantom 17y ago
Exactly! Imagine if your bank had such a redirect URL available, Phishing would be so simple.
- harshavr 17y ago
  Some banks display a customer preselected image after the user name & before entering a password. This seems to be a good solution to phishing if one keeps the username private. Otherwise a site could give you the option of using two part passwords.
  - URSpider94 17y ago
    ... and a study a while back showed that, if you simply don't show that image, a large majority of users don't notice. For this reason, the whole "sitekey" phenomenon strikes me as a waste of time.
    - invisible 17y ago
      This? http://usablesecurity.org/emperor/ http://usablesecurity.org/emperor/ - it is an interesting read. It should also be noted that it's not even a 25% benefit for them, but it does help security, even if slightly. I think lowering phishing 1% could be massive for any major bank.
  - ced 17y ago
    Isn't this incredibly simple to defeat? The phishing site can send your username to the real bank's website and retrieve the image.
    - sagarm 17y ago
      If you do that, the bank will notice a bunch of connections from the same IP for different usernames. You could use a botnet to do the lookups, but that still makes the attack substantially more difficult.
lanaer 17y ago
So it is important to also check the URL in your address bar _after_ you click, as well. This trick won’t be able to fake that.
- ominous_prime 17y ago
  But would you always catch it if you were redirected to www.youtube.com.you1ube.com/something? Or possibly worse - http://www.youtube.com⁄bad-site.com/something_else http://www.youtube.com⁄bad-site.com/something_else
  - lanaer 17y ago
    In this I rely on my browser to filter deceptive characters in domain names. When I hover over the link you gave (or click it and see it in the address bar), it looks like http://www.youtube.xn--combad-site-hx3f.com/something_else http://www.youtube.xn--combad-site-hx3f.com/something_else (which lets off plenty of flags for me).
  - Pistos2 17y ago
    When hovered, then clicked in Opera: opera:illegal-url-24 Error! Invalid URL The URL http://www.youtube.com⁄bad-site.com/something_else http://www.youtube.com⁄bad-site.com/something_else contains characters that are not valid in the location they are found. The reason for their presence may be a mistyped URL, but the URL may also be an attempt to trick you into visiting a Web site which you might mistake for a site you trust.

Wow, I don't like this. My usual tactic of looking for the / after the .tld isn't a general solution anymore. I hope my bank doesn't implement this functionality.

Phantom 17y ago

Exactly! Imagine if your bank had such a redirect URL available, Phishing would be so simple.

harshavr 17y ago
Some banks display a customer preselected image after the user name & before entering a password. This seems to be a good solution to phishing if one keeps the username private. Otherwise a site could give you the option of using two part passwords.
- URSpider94 17y ago
  ... and a study a while back showed that, if you simply don't show that image, a large majority of users don't notice. For this reason, the whole "sitekey" phenomenon strikes me as a waste of time.
  - invisible 17y ago
    This? http://usablesecurity.org/emperor/ http://usablesecurity.org/emperor/ - it is an interesting read. It should also be noted that it's not even a 25% benefit for them, but it does help security, even if slightly. I think lowering phishing 1% could be massive for any major bank.
- ced 17y ago
  Isn't this incredibly simple to defeat? The phishing site can send your username to the real bank's website and retrieve the image.
  - sagarm 17y ago
    If you do that, the bank will notice a bunch of connections from the same IP for different usernames. You could use a botnet to do the lookups, but that still makes the attack substantially more difficult.

lanaer 17y ago

So it is important to also check the URL in your address bar _after_ you click, as well. This trick won’t be able to fake that.

ominous_prime 17y ago
But would you always catch it if you were redirected to www.youtube.com.you1ube.com/something? Or possibly worse - http://www.youtube.com⁄bad-site.com/something_else http://www.youtube.com⁄bad-site.com/something_else
- lanaer 17y ago
  In this I rely on my browser to filter deceptive characters in domain names. When I hover over the link you gave (or click it and see it in the address bar), it looks like http://www.youtube.xn--combad-site-hx3f.com/something_else http://www.youtube.xn--combad-site-hx3f.com/something_else (which lets off plenty of flags for me).
- Pistos2 17y ago
  When hovered, then clicked in Opera: opera:illegal-url-24 Error! Invalid URL The URL http://www.youtube.com⁄bad-site.com/something_else http://www.youtube.com⁄bad-site.com/something_else contains characters that are not valid in the location they are found. The reason for their presence may be a mistyped URL, but the URL may also be an attempt to trick you into visiting a Web site which you might mistake for a site you trust.