3 ms·
I honestly believe that he was trying to prove a point and not phish. I'm cautioning that I think it's a dangerous game to play. A website doesn't need to have
by beager 9y ago
I honestly believe that he was trying to prove a point and not phish. I'm cautioning that I think it's a dangerous game to play.
A website doesn't need to have a "backend" or make a POST request or use a submit button to transmit data that you enter on it to another party. You should assume that ANY ACTION you take on any website is being transmitted to the server or to any third party. Key strokes, mouse moves, time on page, info about your browser and location, all of it.
A bad actor could mimic this sort of "prove a point" site and actually harvest information from unwitting people, all while feigning concern and saying they're proving a point, but carefully disguised JS could be encrypting page events and sending them in cookies to other parties. If we normalize this kind of security grandstanding, we open the the door a little bit wider to phishers.
Browser maintainers were right to mark the site as a phishing site. Because it is. It doesn't matter if it transmitted data or not. I guess you could call that "catch and release".
- nikisweeting 9y agoI was very careful to remove any scripts loaded on the page, and I both disabled the FORM submitting and pointed it to localhost. That being said, your concern is warranted, I think Cloudflare and browsers did the right thing by blocking my site. It served its purpose, and as of 4pm CT today I took it down and destroyed the droplet it was running on. I collected no analytics while it was running off Cloudflare, and kept no logs. Hopefully Equifax doesn't sue me in the next few months.
- beager 9y agoThank you for being forthcoming about all this. I don't mean to be a pain in your ass and I know your intentions are good. I hope this all ends up being a force for good and that things like the NYT coverage help avoid legal issues with Equifax. Good luck to you in that regard. For the record, the favicon requests that went out after "submitting" your site's data did not appear to transmit any form data to that server. I just noticed that it'd be trivially easy to do that if someone else emulated this as a bad actor. I think we can all agree that Equifax chose extremely poorly with a separate domain name, one that is just crassly phishy-sounding already, and opening itself up to actual bad actors.
- scrumper 9y agoSorry to say that I do think you should talk to a lawyer before you do anything else. An initial free consultation would be worthwhile. I’m not sure it’s Equifax suing you that you should be most concerned about. Equifax’s giant fuckup has already stirred up the prosecutorial wasps, they’re all looking for something to sting.