5 ms·

Since everyone is wondering why, and since I happened to stumble across a reason during my time as a pentester, here you go: Spearphishing is still one of the

by shawn 8y ago

Since everyone is wondering why, and since I happened to stumble across a reason during my time as a pentester, here you go: Spearphishing is still one of the most common ways of breaching a corporate network. If I target you, you will likely fall for one of my attempts. If you are a company rather than a person, my odds go way up, because I have N chances to trick someone rather than 1 (where N is roughly the number of people at the company with email access). This is one of those things that everyone says "Ha, I'm smart. I'd notice. You can't trick me." And maybe you are. But you're also distracted. And that's my greatest advantage against you. All I need is to sneak in an unexpected Github prompt that looks completely authentic, and now I have your Github password. Wanna bet you don't have 2FA turned on, even though you know you really ought to? And even if you do, it's getting easier to social engineer your way past AT&T's lovely customer support: https://www.youtube.com/watch?v=caVEiitI2vg https://www.youtube.com/watch?v=caVEiitI2vg Ok, what's the point? This: Every character in the URL bar unrelated to the apex name is a deadly distraction. Right now, how do you know you're actually on HN instead of some knockoff? "ycombinator.com". How many characters do you have to read unrelated to that? "https://news https://news. /item?id=17927972" The most vital part of a URL for vetting identity is also, usually, the hardest to see. Now, I don't know whether google made this change in order to assist with this. But it's one possible justification, and a step in a good direction. We may not like it, just like we didn't like when Google removed the clickable "cached" links from search results, but in this case consumer protection outweighs our urges as a power user.

mrguyorama 8y ago
Firefox fixed this by highlighting the "ycombinator.com" portion of the URL. Zero need to hide the rest from the user
- crispyporkbites 8y ago
  I was just looking at the URL bar in firefox and thinking yea, I know it's ycombinator.com because it's right there, and there's a big green lock on the left. Google can do what they want with Chrome, as far as I'm concerned it's the new IE.
ancarda 8y ago
Wasn't this (partially?) solved by making the domain black and the rest of the text gray? That's how it appears in Firefox. It makes it very easy to see "ycombinator.com".
- tialaramex 8y ago
  According to the PSL their list is also used for this purpose in Internet Explorer, but not other browsers. (The Public Suffix List is the Mozilla project that knows .co.uk isn't the same kind of thing as .google.com even though they both have two DNS labels. These days every non-crap browser uses it to restrict cross domain cookies but they aren't consistent when it comes to other features)
- neogodless 8y ago
  Is this specific to a version of Firefox, or an extension? I'm using Firefox 62.0, and I do not see a difference in color between the domain and the rest of the URL. (Windows 10, 1080p screen.) ETA: Holy crap, if I zoom into a screenshot, I can see the difference. My eyes cannot benefit from this feature under normal circumstances, though. Looks like black (#000000) and gray (#807D7D).
  - Freak_NL 8y ago
    I get #9D9D9D on Firefox 61 on Ubuntu (1080p). It is perfectly clear to me. If you have trouble distinguishing between the grey and black, perhaps file a bug report requesting to slightly lower the saturation of the grey? Or perhaps your browser's theme is using that darker grey?
    - crispyporkbites 8y ago
      the parent might actually need an eyetest...
  - Macha 8y ago
    You may want to check your monitor's brightness/gamma settings. That's a major difference to be invisble, and there's many sites that use light grey on white which are much much closer than this (sadly :( )
gouggoug 8y ago
As true as this is, hiding the "www." subdomain isn't the right solution. For starters, it doesn't work for non "www." subdomains, for example... news.ycombinator.com isn't protected by this solution. A better solution IMHO, would be to do it like firefox, grey it out.
avaer 8y ago
Of the reasons I'd buy for Google being incentivised to do this, preventing spearphishing would be low on the list.
- JeremyBanks 8y ago
  Then you haven’t been paying attention.
deleted 8y ago
[deleted]
buster 8y ago
Funny that you mention that, i never noticed, but firefox displays "ycombinator.com" in the URL "https://news.ycombinator.com/" https://news.ycombinator.com/" in black, while other parts you are talking about are light gray. Seems more reasonable then hiding parts.
fmpwizard 8y ago
if the idea is to protect users so that you don't end up clicking on https://news.ycombinator.com.myhackerdomain.com https://news.ycombinator.com.myhackerdomain.com , you then open the attack of a platform where they offer custom subdomains, and you have https://original.blogger.com https://original.blogger.com and then https://fake-original.blogger.com https://fake-original.blogger.com if I make them look the same, and the address will hide the subdomain, it looks like a step backwards in securing the web now, imagine the actual platform has a payment section, and I create a fake subdomain that looks pretty similar, email you, boom, I get your cc info because I tricked you into entering new cc info (assuming your scenario of someone being distracted)
- pishpash 8y ago
  Google and parent both think they know better than you what is the "important" part of the URL.
- Sohcahtoa82 8y ago
  Only supposed "trivial" subdomains are hidden, such as www. and m. Anything else is still shown. fake-original.blogger.com will still show up as fake-original.blogger.com because fake-original. isn't a trivial subdomain. I still think it's a stupid move, though. It's a simplification that is incredibly unnecessary and may be harmful when dealing with the rare site that doesn't treat www.domain.com and domain.com as the same.
- what_ever 8y ago
  Except original and fake-original is not hidden. Try opening https://opensource.googleblog.com/ https://opensource.googleblog.com/ https://security.googleblog.com/ https://security.googleblog.com/ Both opensource and security are shown. Disc: Googler but don't work on this project.
deleted 8y ago
[deleted]
nine_k 8y ago
Do not hide the relevant info. Nearly every character in the URL is relevant info. Instead, make the key part stand out, so even a cursory glance catches it instantly. It still allows more careful examination without clicking anywhere, or second-guessing. Also, detect anomalies like www.google.com.hacked.domain.wtf, and show them in a really contrast way. Both Chrome and FF do this already. I think Firefox shows normal URLs about right; they could add even more contrast.
dwheeler 8y ago
> This: Every character in the URL bar unrelated to the apex name is a deadly distraction. I'm not convinced. When your tools lie you (as this does), you are LESS likely to notice a problem when you're busy. Another way to view this approach is: > Every character in the URL bar different from the actual URL is a deadly lie. Distraction is a problem, I totally agree, but other methods like Firefox's color-shading seem to work just fine.
Pxtl 8y ago
More targeted solutions: Flag websites that look like phishing URLs - websites that contain domain names of popular websites in their subdomains or other parts of the URI. But initially, don't do anything. it could be harmless. AMP has domain names in the URI, right? But, as soon as the user starts typing into a text-entry field (especially a password one), you bring a pop-up warning them that this might be a phishing site.

by shawn 8y ago

mrguyorama 8y ago

Firefox fixed this by highlighting the "ycombinator.com" portion of the URL. Zero need to hide the rest from the user

crispyporkbites 8y ago
I was just looking at the URL bar in firefox and thinking yea, I know it's ycombinator.com because it's right there, and there's a big green lock on the left. Google can do what they want with Chrome, as far as I'm concerned it's the new IE.

ancarda 8y ago

Wasn't this (partially?) solved by making the domain black and the rest of the text gray? That's how it appears in Firefox. It makes it very easy to see "ycombinator.com".

tialaramex 8y ago
According to the PSL their list is also used for this purpose in Internet Explorer, but not other browsers. (The Public Suffix List is the Mozilla project that knows .co.uk isn't the same kind of thing as .google.com even though they both have two DNS labels. These days every non-crap browser uses it to restrict cross domain cookies but they aren't consistent when it comes to other features)
neogodless 8y ago
Is this specific to a version of Firefox, or an extension? I'm using Firefox 62.0, and I do not see a difference in color between the domain and the rest of the URL. (Windows 10, 1080p screen.) ETA: Holy crap, if I zoom into a screenshot, I can see the difference. My eyes cannot benefit from this feature under normal circumstances, though. Looks like black (#000000) and gray (#807D7D).
- Freak_NL 8y ago
  I get #9D9D9D on Firefox 61 on Ubuntu (1080p). It is perfectly clear to me. If you have trouble distinguishing between the grey and black, perhaps file a bug report requesting to slightly lower the saturation of the grey? Or perhaps your browser's theme is using that darker grey?
  - crispyporkbites 8y ago
    the parent might actually need an eyetest...
- Macha 8y ago
  You may want to check your monitor's brightness/gamma settings. That's a major difference to be invisble, and there's many sites that use light grey on white which are much much closer than this (sadly :( )

gouggoug 8y ago

As true as this is, hiding the "www." subdomain isn't the right solution. For starters, it doesn't work for non "www." subdomains, for example... news.ycombinator.com isn't protected by this solution. A better solution IMHO, would be to do it like firefox, grey it out.

avaer 8y ago

Of the reasons I'd buy for Google being incentivised to do this, preventing spearphishing would be low on the list.

JeremyBanks 8y ago
Then you haven’t been paying attention.

deleted 8y ago

[deleted]

buster 8y ago

Funny that you mention that, i never noticed, but firefox displays "ycombinator.com" in the URL "https://news.ycombinator.com/" https://news.ycombinator.com/" in black, while other parts you are talking about are light gray. Seems more reasonable then hiding parts.

fmpwizard 8y ago

if the idea is to protect users so that you don't end up clicking on https://news.ycombinator.com.myhackerdomain.com https://news.ycombinator.com.myhackerdomain.com , you then open the attack of a platform where they offer custom subdomains, and you have https://original.blogger.com https://original.blogger.com and then https://fake-original.blogger.com https://fake-original.blogger.com if I make them look the same, and the address will hide the subdomain, it looks like a step backwards in securing the web now, imagine the actual platform has a payment section, and I create a fake subdomain that looks pretty similar, email you, boom, I get your cc info because I tricked you into entering new cc info (assuming your scenario of someone being distracted)

pishpash 8y ago
Google and parent both think they know better than you what is the "important" part of the URL.
Sohcahtoa82 8y ago
Only supposed "trivial" subdomains are hidden, such as www. and m. Anything else is still shown. fake-original.blogger.com will still show up as fake-original.blogger.com because fake-original. isn't a trivial subdomain. I still think it's a stupid move, though. It's a simplification that is incredibly unnecessary and may be harmful when dealing with the rare site that doesn't treat www.domain.com and domain.com as the same.
what_ever 8y ago
Except original and fake-original is not hidden. Try opening https://opensource.googleblog.com/ https://opensource.googleblog.com/ https://security.googleblog.com/ https://security.googleblog.com/ Both opensource and security are shown. Disc: Googler but don't work on this project.

deleted 8y ago

[deleted]

nine_k 8y ago

Do not hide the relevant info. Nearly every character in the URL is relevant info. Instead, make the key part stand out, so even a cursory glance catches it instantly. It still allows more careful examination without clicking anywhere, or second-guessing. Also, detect anomalies like www.google.com.hacked.domain.wtf, and show them in a really contrast way. Both Chrome and FF do this already. I think Firefox shows normal URLs about right; they could add even more contrast.

dwheeler 8y ago

> This: Every character in the URL bar unrelated to the apex name is a deadly distraction. I'm not convinced. When your tools lie you (as this does), you are LESS likely to notice a problem when you're busy. Another way to view this approach is: > Every character in the URL bar different from the actual URL is a deadly lie. Distraction is a problem, I totally agree, but other methods like Firefox's color-shading seem to work just fine.

Pxtl 8y ago

More targeted solutions: Flag websites that look like phishing URLs - websites that contain domain names of popular websites in their subdomains or other parts of the URI. But initially, don't do anything. it could be harmless. AMP has domain names in the URI, right? But, as soon as the user starts typing into a text-entry field (especially a password one), you bring a pop-up warning them that this might be a phishing site.