7 ms·

What if you just don't click on any links in email? Particularly if they are really important sites. Just accomplish the proposed task another way. For examp

What if you just don't click on any links in email? Particularly if they are really important sites. Just accomplish the proposed task another way. For example, if you get an email from Paypal, stating that you need to update a credit card or something, don't click their link, instead open a browser and enter "https://www.paypal.com" https://www.paypal.com" yourself, and go into your account information and look for your saved payment methods. edit: typos

Adverblessly 10y ago
I always hover over links before I click them to see where they actually lead in the status bar. It is less safe than your suggestion (since if I'm not careful I can fall for "googel.com" or "goog1e.com"), but is still often useful (even just to avoid going somewhere I'm not interested in going, not specifically against phishing).
- cmurf 10y ago
  This does not work if the link is in a browser translating punycode, i.e. if the URL is in gmail or as in this example in a web article, hovering over the link shows the translated punycode, i.e. apple.com. If you're in Firefox, about:config, search puny, change that from false to true, NOW when you hover over this URL you'll see the untranslated punycode which is the real URL.
  - wutbrodo 10y ago
    In mobile chrome at least, the xn-- URL showed up when long pressing instead of the apple one. Once clicked, it rendered as apple
- JoshCole 10y ago
  I think you skipped reading the article. The article is about punycode. Using it, you can have a site name like 'apple.com' even though really the domain is made up of various unicode characters. So even if you were exceedingly careful and you made sure not to fail for googel.com and goog1e.com, you would still fall for the visually correct google.com.
  - deleted 10y ago
    [deleted]
- noooop 10y ago
  The status bar is completely worthless and unreliable from a security standpoint unless you disable javascript. javascript can intercept your click and navigate you anywhere it wants.
jandrese 10y ago
The only time I click on links in emails is when I've just requested them. Like I've just set up an account and it says it is sending me an email to verify the address. If it is some email out of the blue I would never click the link or open the attachment. I actually enforce the attachment rule by configuring my mail client to only support "save" as an option for attachments.
askmike 10y ago
What about links on websites? Do you also not click those?
- zeroer 10y ago
  If it's to my bank or email account, no, for the same reasons.
  - askmike 10y ago
    I meant it more as a rhetorical question: even if you really don't click on any link to any of your important accounts _ever_, you are still vulnerable: - if you install a malicious browser add-on (or if the guy behind one you already have gets phished and pushes a malicious update). - if any other part of your system/browser ever gets compromised. - If you mistype the address and your browser searches on Google/bing instead you can be phished from the ad links at the top.
    - et-al 10y ago
      If you have a malicious browser add-on or your system/browser is compromised, you're pretty much pwnt, aren't you? The only hurdle left would be TOTP or Yubikey.
diminoten 10y ago
A good way to get a lot of people with a phishing attempt is the 'Unsubscribe' button in an email.
- peterhadlaw 10y ago
  Could you expand upon this? Do you mean the unsubscribe takes you to somewhere you need to then sign in with credentials to "unsubscribe"?
  - lucasmullens 10y ago
    I've definitely seen websites that require you to login to unsubscribe. It's probably illegal (https://arstechnica.com/tech-policy/2012/09/log-in-to-unsubscribe-from-this-e-mail-annoying-possibly-illegal/ https://arstechnica.com/tech-policy/2012/09/log-in-to-unsubs...) but I still see it from time to time. Usually I just mark them as spam and don't bother logging in.
    - gnicholas 10y ago
      It's also super annoying when someone has accidentally entered your email address instead of their own. When you try to unsubscribe, you're asked to log in to an account that you never created.
  - diminoten 10y ago
    They could put whatever is most effective at the destination of that URL. Once you're visiting a URL crafted by the attacker, you're already in deep trouble. Often that's all it takes, merely visiting the URL.
    - Dylan16807 10y ago
      If you assume people have the attention span of gnats, I guess. If I'm clicking a link to unsubscribe you're not going to get me to start entering personal information.
abecedarius 10y ago
This is a good use for bookmarks, too.
deleted 10y ago
[deleted]
pasta 10y ago
Our government (Netherlands) doesn't provide links in emails. They even don't provide the domain name (which can be turned in to a link by the client), but refer to the website with the name of the website. For example: "There is a new message in your inbox on MijnOverheid. Please visit MijnOverheid to read this message." And every time they also warn that they never will provide any link in any email. I would be great if more (all) websites start doing this.
- Doxin 10y ago
  Unfortunately they also have a habit of moving the login form around, especially the one related to business taxes.

Adverblessly 10y ago

I always hover over links before I click them to see where they actually lead in the status bar. It is less safe than your suggestion (since if I'm not careful I can fall for "googel.com" or "goog1e.com"), but is still often useful (even just to avoid going somewhere I'm not interested in going, not specifically against phishing).

cmurf 10y ago
This does not work if the link is in a browser translating punycode, i.e. if the URL is in gmail or as in this example in a web article, hovering over the link shows the translated punycode, i.e. apple.com. If you're in Firefox, about:config, search puny, change that from false to true, NOW when you hover over this URL you'll see the untranslated punycode which is the real URL.
- wutbrodo 10y ago
  In mobile chrome at least, the xn-- URL showed up when long pressing instead of the apple one. Once clicked, it rendered as apple
JoshCole 10y ago
I think you skipped reading the article. The article is about punycode. Using it, you can have a site name like 'apple.com' even though really the domain is made up of various unicode characters. So even if you were exceedingly careful and you made sure not to fail for googel.com and goog1e.com, you would still fall for the visually correct google.com.
- deleted 10y ago
  [deleted]
noooop 10y ago
The status bar is completely worthless and unreliable from a security standpoint unless you disable javascript. javascript can intercept your click and navigate you anywhere it wants.

jandrese 10y ago

The only time I click on links in emails is when I've just requested them. Like I've just set up an account and it says it is sending me an email to verify the address. If it is some email out of the blue I would never click the link or open the attachment. I actually enforce the attachment rule by configuring my mail client to only support "save" as an option for attachments.

askmike 10y ago

What about links on websites? Do you also not click those?

zeroer 10y ago
If it's to my bank or email account, no, for the same reasons.
- askmike 10y ago
  I meant it more as a rhetorical question: even if you really don't click on any link to any of your important accounts _ever_, you are still vulnerable: - if you install a malicious browser add-on (or if the guy behind one you already have gets phished and pushes a malicious update). - if any other part of your system/browser ever gets compromised. - If you mistype the address and your browser searches on Google/bing instead you can be phished from the ad links at the top.
  - et-al 10y ago
    If you have a malicious browser add-on or your system/browser is compromised, you're pretty much pwnt, aren't you? The only hurdle left would be TOTP or Yubikey.

diminoten 10y ago

A good way to get a lot of people with a phishing attempt is the 'Unsubscribe' button in an email.

peterhadlaw 10y ago
Could you expand upon this? Do you mean the unsubscribe takes you to somewhere you need to then sign in with credentials to "unsubscribe"?
- lucasmullens 10y ago
  I've definitely seen websites that require you to login to unsubscribe. It's probably illegal (https://arstechnica.com/tech-policy/2012/09/log-in-to-unsubscribe-from-this-e-mail-annoying-possibly-illegal/ https://arstechnica.com/tech-policy/2012/09/log-in-to-unsubs...) but I still see it from time to time. Usually I just mark them as spam and don't bother logging in.
  - gnicholas 10y ago
    It's also super annoying when someone has accidentally entered your email address instead of their own. When you try to unsubscribe, you're asked to log in to an account that you never created.
- diminoten 10y ago
  They could put whatever is most effective at the destination of that URL. Once you're visiting a URL crafted by the attacker, you're already in deep trouble. Often that's all it takes, merely visiting the URL.
  - Dylan16807 10y ago
    If you assume people have the attention span of gnats, I guess. If I'm clicking a link to unsubscribe you're not going to get me to start entering personal information.

abecedarius 10y ago

This is a good use for bookmarks, too.

deleted 10y ago

[deleted]

pasta 10y ago

Our government (Netherlands) doesn't provide links in emails. They even don't provide the domain name (which can be turned in to a link by the client), but refer to the website with the name of the website. For example: "There is a new message in your inbox on MijnOverheid. Please visit MijnOverheid to read this message." And every time they also warn that they never will provide any link in any email. I would be great if more (all) websites start doing this.

Doxin 10y ago
Unfortunately they also have a habit of moving the login form around, especially the one related to business taxes.