3 ms·

withgoogle.com is more of a 'sandbox' for Google one-off programs, labs, events, etc. which don't need to have the same branding guidelines as on google.com dom

withgoogle.com is more of a 'sandbox' for Google one-off programs, labs, events, etc. which don't need to have the same branding guidelines as on google.com domain.

scarmig 8y ago
...so? It's still a phishing vector. Teaching users that sometimes Google throws together half-assed domains encourages them to trust any domain with "google" in it.
- scarmig 8y ago
  Just for example, the following domains are all available: workingoogle.com labsgoogle.com labsatgoogle.com learngoogle.org learnatgoogle.com youatgoogle.com bygoogle.co securitywithgoogle.com mailatgoogle.com realgoogle.com etc.
- bduerst 8y ago
  AFAIK they don't have any pages there that allow account login, for that and other security reasons.
  - owaty 8y ago
    Yes, but: > Create a name and email — neither need to be real — to make this quiz seem more realistic. Don’t worry, this information won’t leave your device. I'd trust this notice if I knew it came from Google, but since it was placed on a phishy-looking website, it really gave me pause.
  - zulln 8y ago
    https://www.google.com/search?q=site%3Awithgoogle.com+login https://www.google.com/search?q=site%3Awithgoogle.com+login
  - scarmig 8y ago
    That doesn't help the situation much, even if it were true. If a phisher creates a fake Google domain, how many users will go, "Aha! I was about to login using my Google credentials, but then I remembered Google only asks users to login to *.google.com domains, so I know this is an attempted phish!"
dagurp 8y ago
I assumed that I passed the test by not filling out the form
- Zarel 8y ago
  You're supposed to use whatever information you wanted the example phishing e-mails do be directed to. I used "Bob" and "bob@example.com".
  - scarmig 8y ago
    I guarantee at least 25% of users used their real name and email.
Narkov 8y ago
Ask Equifax why this is such a terrible idea: https://www.nytimes.com/2017/09/20/business/equifax-fake-website.html https://www.nytimes.com/2017/09/20/business/equifax-fake-web...

withgoogle.com is more of a 'sandbox' for Google one-off programs, labs, events, etc. which don't need to have the same branding guidelines as on google.com domain.

scarmig 8y ago

...so? It's still a phishing vector. Teaching users that sometimes Google throws together half-assed domains encourages them to trust any domain with "google" in it.

scarmig 8y ago
Just for example, the following domains are all available: workingoogle.com labsgoogle.com labsatgoogle.com learngoogle.org learnatgoogle.com youatgoogle.com bygoogle.co securitywithgoogle.com mailatgoogle.com realgoogle.com etc.
bduerst 8y ago
AFAIK they don't have any pages there that allow account login, for that and other security reasons.
- owaty 8y ago
  Yes, but: > Create a name and email — neither need to be real — to make this quiz seem more realistic. Don’t worry, this information won’t leave your device. I'd trust this notice if I knew it came from Google, but since it was placed on a phishy-looking website, it really gave me pause.
- zulln 8y ago
  https://www.google.com/search?q=site%3Awithgoogle.com+login https://www.google.com/search?q=site%3Awithgoogle.com+login
- scarmig 8y ago
  That doesn't help the situation much, even if it were true. If a phisher creates a fake Google domain, how many users will go, "Aha! I was about to login using my Google credentials, but then I remembered Google only asks users to login to *.google.com domains, so I know this is an attempted phish!"

dagurp 8y ago

I assumed that I passed the test by not filling out the form

Zarel 8y ago
You're supposed to use whatever information you wanted the example phishing e-mails do be directed to. I used "Bob" and "bob@example.com".
- scarmig 8y ago
  I guarantee at least 25% of users used their real name and email.

Narkov 8y ago

Ask Equifax why this is such a terrible idea: https://www.nytimes.com/2017/09/20/business/equifax-fake-website.html https://www.nytimes.com/2017/09/20/business/equifax-fake-web...