6 ms·
I am not a lawyer. I would strongly advise you to instead make it so obvious that the site is a lampoon. As in, when they enter, you respond with "This site is
by wheaties 9y ago
I am not a lawyer. I would strongly advise you to instead make it so obvious that the site is a lampoon. As in, when they enter, you respond with "This site is a mockery of Equifax. If you were lead here by Equifax or any affiliate, you are at the wrong site. I'm sorry, I can't help you. I can reinforce that if your information was compromised, more people may be attempting you use this to phish additional people."
- nikisweeting 9y agoTry entering some fake data into the form and hitting "Continue", I put a pretty clear message there, but I guess I can also put it elsewhere.
- rory096 9y agos/loose/lose on that alert box
- nikisweeting 9y agoFixed, thanks.
- beager 9y agoDevil's advocate: how does anyone know you're not actually phishing with this site?
- chipperyman573 9y agoYou can watch the network using the network tab in devtools. No data is sent on the form's page.
- beager 9y agoMy point is, a layman may not know that, a judge may not care.
- jonny_eh 9y agoA judge may not care about anything then. They may not care about a big disclaimer either.
- softawre 9y agoBut you said "anyone" in a programmer-friendly thread.
- beager 9y agoFair enough, I will be trampled by pedantry then!
- omginternets 9y ago>a judge may not care Why? This seems like clear and compelling evidence that the site was not designed to actually phish.
- beager 9y agoWas the site not designed to actually phish? - The site contains Equifax's heading, uses their branding, and is highly similar to the actual website - The site is hosted on a domain that is very similar to the actual website and uses Equifax's name - The site instructs users to enter PII on it under the guise of being Equifax. It could be argued that the creator of the site created this to determine whether people were being phished by it before activating the actual collection of data. Additionally, in Chrome, when I fill out the form and get the alert box, when I dismiss the alert box, two requests are made to the domain: https://securityequifax2017.com/eligibility/images/favicon-32x32.png https://securityequifax2017.com/eligibility/images/favicon-3... https://securityequifax2017.com/eligibility/images/favicon-16x16.png https://securityequifax2017.com/eligibility/images/favicon-1... If an onSubmit handler is attached to the form submit that sets a cookie with this information before showing the alert, then the phished details are transmitted to securityequifax2017.com. Lawyers will C&D this extremely hard, a very reasonable case can be made that this is impersonation, and a phishing site with malicious intent. NB: I DO NOT BELIEVE THAT THIS IS THE CREATOR'S INTENT. So do not jump at me thinking that I do believe that. I'm just saying that it could be very reasonably and successfully argued, and that nuance and intent could do very little to spurn allegations of impersonation or actual phishing.
- VMG 9y agohttps://github.com/sindresorhus/devtools-detect https://github.com/sindresorhus/devtools-detect
- daveFNbuck 9y agoYour site doesn't use https. It's a bit late to put the clear message after people send sensitive data over an insecure connection.
- wyager 9y agoNo form data is sent. Only an active MiTM would make this a risk.
- EGreg 9y agoBut the server page with the form could be MiTM, is the point.
- brazzledazzle 9y agoYep. Even though it posts to https://127.0.0.1 https://127.0.0.1 since the page itself isn't https it could have scripts injected into it over the wire.
- nikisweeting 9y agoDespite having 127.0.0.1 in the action field, the form does not actually submit, you can verify with the dev tools.
- nikisweeting 9y agoCheck again, there was a short period of a few minutes without https when I switched off Cloudflare, but now all http requests are redirected to https.
- brazzledazzle 9y agoIf I were you I'd pop up an alert on clicking or tabbing into any of the form fields. It would get the message across without someone having to enter their private information into a page served over an insecure connection.
- nikisweeting 9y agoIt was only briefly served via http while I switched off cloudflare, everything is redirected to https now.
- brazzledazzle 9y agoThats great to hear. Good job making them look like the fools they ard by the way.
- ceejayoz 9y agoThe first thing you see on the site is giant text stating "Cybersecurity Incident & Important Consumer Information Which is Totally Fake, Why Did Equifax Use A Domain That's So Easily Impersonated By Phishing Sites?" (Plus, Cloudflare's flagging it as phishing now, haha.)
- nikisweeting 9y agoI just took it off Cloudflare and switched to Letsencrypt. No biggie, I'm glad Cloudflare is proactive and flags things as phishing that fast.
- brazzledazzle 9y agoYou should force a redirect of anything http to the corresponding https URL. You can do it dynamically so it preserves any direct links in case you're worried about that.
- nikisweeting 9y agoCheck it now.