3 ms·

While the domain is a legit Google domain, I find it ironic that it’s hosted on “withgoogle.com”. If my parents followed my anti-phishing tips they would fail b

While the domain is a legit Google domain, I find it ironic that it’s hosted on “withgoogle.com”. If my parents followed my anti-phishing tips they would fail by clicking this link.

bduerst 8y ago
withgoogle.com is more of a 'sandbox' for Google one-off programs, labs, events, etc. which don't need to have the same branding guidelines as on google.com domain.
- scarmig 8y ago
  ...so? It's still a phishing vector. Teaching users that sometimes Google throws together half-assed domains encourages them to trust any domain with "google" in it.
  - scarmig 8y ago
    Just for example, the following domains are all available: workingoogle.com labsgoogle.com labsatgoogle.com learngoogle.org learnatgoogle.com youatgoogle.com bygoogle.co securitywithgoogle.com mailatgoogle.com realgoogle.com etc.
  - bduerst 8y ago
    AFAIK they don't have any pages there that allow account login, for that and other security reasons.
    - owaty 8y ago
      Yes, but: > Create a name and email — neither need to be real — to make this quiz seem more realistic. Don’t worry, this information won’t leave your device. I'd trust this notice if I knew it came from Google, but since it was placed on a phishy-looking website, it really gave me pause.
    - zulln 8y ago
      https://www.google.com/search?q=site%3Awithgoogle.com+login https://www.google.com/search?q=site%3Awithgoogle.com+login
    - scarmig 8y ago
      That doesn't help the situation much, even if it were true. If a phisher creates a fake Google domain, how many users will go, "Aha! I was about to login using my Google credentials, but then I remembered Google only asks users to login to *.google.com domains, so I know this is an attempted phish!"
- dagurp 8y ago
  I assumed that I passed the test by not filling out the form
  - Zarel 8y ago
    You're supposed to use whatever information you wanted the example phishing e-mails do be directed to. I used "Bob" and "bob@example.com".
    - scarmig 8y ago
      I guarantee at least 25% of users used their real name and email.
- Narkov 8y ago
  Ask Equifax why this is such a terrible idea: https://www.nytimes.com/2017/09/20/business/equifax-fake-website.html https://www.nytimes.com/2017/09/20/business/equifax-fake-web...
baroffoos 8y ago
Google has one billion different domain names that they officially use for user facing features. Why would they register blog.google and use it other than to show off that they have their own tld
londons_explore 8y ago
It's because google.com contains very valuable cookies which could be leaked if there was an XSS or something anywhere on the google.com domain. Thats why things like this (which are often developed by third party contractors, and might not go through the same level of review), are hosted on another domain. It's a flaw in the web though. A domain should have the ability to host content without that content gaining full control over the secrets/cookies of the hosting domain.
- theossuary 8y ago
  If they mark the cookies as http only then that wouldn't be a concern though, for xss attacks anyway. Subdomains would also solve that issue. https://www.owasp.org/index.php/HttpOnly https://www.owasp.org/index.php/HttpOnly Personally I think they separate them out for branding. Things that are on google.com are flagship products, and getting your thing under google.com means you and/or you're project has a lot of clot at Google.
  - londons_explore 8y ago
    Httponly wouldnt solve the issue - the serverside code also shouldn't be trusted with such cookies. Cookies aren't the only permission either - Google wouldn't want webcam or audio recording permission to be given to a 'withgoogle' site without the users consent either.

While the domain is a legit Google domain, I find it ironic that it’s hosted on “withgoogle.com”. If my parents followed my anti-phishing tips they would fail by clicking this link.

bduerst 8y ago

withgoogle.com is more of a 'sandbox' for Google one-off programs, labs, events, etc. which don't need to have the same branding guidelines as on google.com domain.

scarmig 8y ago
...so? It's still a phishing vector. Teaching users that sometimes Google throws together half-assed domains encourages them to trust any domain with "google" in it.
- scarmig 8y ago
  Just for example, the following domains are all available: workingoogle.com labsgoogle.com labsatgoogle.com learngoogle.org learnatgoogle.com youatgoogle.com bygoogle.co securitywithgoogle.com mailatgoogle.com realgoogle.com etc.
- bduerst 8y ago
  AFAIK they don't have any pages there that allow account login, for that and other security reasons.
  - owaty 8y ago
    Yes, but: > Create a name and email — neither need to be real — to make this quiz seem more realistic. Don’t worry, this information won’t leave your device. I'd trust this notice if I knew it came from Google, but since it was placed on a phishy-looking website, it really gave me pause.
  - zulln 8y ago
    https://www.google.com/search?q=site%3Awithgoogle.com+login https://www.google.com/search?q=site%3Awithgoogle.com+login
  - scarmig 8y ago
    That doesn't help the situation much, even if it were true. If a phisher creates a fake Google domain, how many users will go, "Aha! I was about to login using my Google credentials, but then I remembered Google only asks users to login to *.google.com domains, so I know this is an attempted phish!"
dagurp 8y ago
I assumed that I passed the test by not filling out the form
- Zarel 8y ago
  You're supposed to use whatever information you wanted the example phishing e-mails do be directed to. I used "Bob" and "bob@example.com".
  - scarmig 8y ago
    I guarantee at least 25% of users used their real name and email.
Narkov 8y ago
Ask Equifax why this is such a terrible idea: https://www.nytimes.com/2017/09/20/business/equifax-fake-website.html https://www.nytimes.com/2017/09/20/business/equifax-fake-web...

baroffoos 8y ago

Google has one billion different domain names that they officially use for user facing features. Why would they register blog.google and use it other than to show off that they have their own tld

londons_explore 8y ago

It's because google.com contains very valuable cookies which could be leaked if there was an XSS or something anywhere on the google.com domain. Thats why things like this (which are often developed by third party contractors, and might not go through the same level of review), are hosted on another domain. It's a flaw in the web though. A domain should have the ability to host content without that content gaining full control over the secrets/cookies of the hosting domain.

theossuary 8y ago
If they mark the cookies as http only then that wouldn't be a concern though, for xss attacks anyway. Subdomains would also solve that issue. https://www.owasp.org/index.php/HttpOnly https://www.owasp.org/index.php/HttpOnly Personally I think they separate them out for branding. Things that are on google.com are flagship products, and getting your thing under google.com means you and/or you're project has a lot of clot at Google.
- londons_explore 8y ago
  Httponly wouldnt solve the issue - the serverside code also shouldn't be trusted with such cookies. Cookies aren't the only permission either - Google wouldn't want webcam or audio recording permission to be given to a 'withgoogle' site without the users consent either.