4 ms·

Correct me if I'm wrong, but that embedded image (pretending to be an attachment) redirects you to a (fake) Gmail login page. How is that supposed to trick anyo

Correct me if I'm wrong, but that embedded image (pretending to be an attachment) redirects you to a (fake) Gmail login page. How is that supposed to trick anyone? I mean, isn't it unusual (i.e. never happens) for attachments to take you to a Gmail login page? So that's suspicious behaviour right there. How is it a serious phishing attack that's getting so much attention on a platform like HN where people are used to much more sophisticated hacks? Unless you're implying that visiting that website (fake login page) itself could harm the user's device, is there some detail that I'm missing here?

skykooler 10y ago
An attachment could take you to a login page if your Google account was logged out after you loaded Gmail. I've actually had this happen when I suspended my laptop (with a gmail tab open), got on a plane, and opened it again when I got off. When I tried to do something in Gmail again I was logged out (and when I logged in again I got the email from Google "Was this you?")
- shadowlord 10y ago
  Yes I agree, in the situation you described, this becomes a legitimate threat. Thanks for pointing that one out.
et-al 10y ago
Part of why we're impressed (and dismayed) is that they use a data URL to look like "accounts.google.com" and to load a remote script out of sight to the right of all the spaces. Maybe the URL protocol didn't fool you, but I think there are a good number of users out there who have been "trained" to check the URL to see that it says "accounts.google.com" and think it's fine. And while clicking on an attachment shouldn't sign out a user, being automatically signed out has happened enough to most people that it seems like a fairly innocuous event, especially since this is supposed to be an attachment, not a link, and you just need to sign back in. So one does.
- shadowlord 10y ago
  Yes, getting automatically signed out is a normal thing. And of course, the user wouldn't suspect that it was the attachment that caused that. So yes, I see it now how this is a legitimate concern.
- Ajedi32 10y ago
  So how is this any different from using a URL like `accounts.google.com.googlelogin.cz` instead? I mean, yes obviously using a `data:` URL is certainly creative, but is it really any more effective?

skykooler 10y ago

An attachment could take you to a login page if your Google account was logged out after you loaded Gmail. I've actually had this happen when I suspended my laptop (with a gmail tab open), got on a plane, and opened it again when I got off. When I tried to do something in Gmail again I was logged out (and when I logged in again I got the email from Google "Was this you?")

shadowlord 10y ago
Yes I agree, in the situation you described, this becomes a legitimate threat. Thanks for pointing that one out.

et-al 10y ago

Part of why we're impressed (and dismayed) is that they use a data URL to look like "accounts.google.com" and to load a remote script out of sight to the right of all the spaces. Maybe the URL protocol didn't fool you, but I think there are a good number of users out there who have been "trained" to check the URL to see that it says "accounts.google.com" and think it's fine. And while clicking on an attachment shouldn't sign out a user, being automatically signed out has happened enough to most people that it seems like a fairly innocuous event, especially since this is supposed to be an attachment, not a link, and you just need to sign back in. So one does.

shadowlord 10y ago
Yes, getting automatically signed out is a normal thing. And of course, the user wouldn't suspect that it was the attachment that caused that. So yes, I see it now how this is a legitimate concern.
Ajedi32 10y ago
So how is this any different from using a URL like `accounts.google.com.googlelogin.cz` instead? I mean, yes obviously using a `data:` URL is certainly creative, but is it really any more effective?