6 ms·

Plead HN: Please be careful with your information

• DanielStraight 16y ago
  I avoid phishing with some basic rules: 1. Never give passwords to a third party (so, for example, no Mint). 2. Never give anything more than an email address to someone you wouldn't also give your credit card number to. I only give an address or phone number when I'm planning on buying something. 3. Never log in after following a link. Always log in by manually (either through typing the URL or a bookmark) visiting the site.
  • jey 16y ago
    Can you explain (3)? Isn't it enough to check whether you're on the right domain before logging in? Or is this to prevent logging in at an IDN URL that looks like the real URL?
    • DanielStraight 16y ago
      Domain check is good, but can be misread, especially with IDNs. Of course, URLs can be mistyped too and a lot of phishing is based on typos of URLs. So really, in the end, you should always follow a bookmark before logging in.
      • pornel 16y ago
        I trust my password manager. It auto-fills my passwords only on correct domains. When my password manager doesn't work, I'm highly suspicious. Plus I use passwords that are auto-generated based on domain name, which I copy & paste to the generator. Hopefully this makes me immune to homograph attacks.
        • francoisdevlin 16y ago
          What pm do you use?
          • giu 16y ago
            1Password Password Manager and Form Filler may be an option: http://www.apple.com/downloads/macosx/networking_security/1passwordpasswordmanagerandformfiller.html http://www.apple.com/downloads/macosx/networking_security/1p...
          • pornel 16y ago
            Opera's built-in “Wand” + my own script. I like that Opera highlights recognized fields, but doesn't fill them in until I tell it to.
      • acangiano 16y ago
        1Password takes care of that for me. I don't see any accounts available if I'm on the wrong domain name.
    • subbu 16y ago
      I fell for this trick with twitter-alike url. 2 things did it for me. The link was from a friend of mine (of course he didn't know that was phishing site). And, it was a replica of Twitter. To make things worse it was shortened using bit.ly. I realized I made a mistake only after I entered password and hit submit. I quickly logged into twitter and changed my password.
    • reduxredacted 16y ago
      There's various reasons that #3 is particularly useful, though I think the original writer was probably more concerned with links in e-mail or links on sites other than the site you're being asked to log in to (such as links from advertisements or other third-party sites): 1) Similarities in the way letters look in certain fonts can cause you to think you're on the correct site when you are not. This is mitigated by EV SSL usually, but if you're not paying close attention you might miss it. 2) Browser exploits (though I'm unaware of any specific ones in current browsers) have commonly focused on tricking the browser into displaying one URL when the page is actually being hosted by another. 3) Links in e-mail, specifically, asking you to "login and update your information" (or "login and sign up for paperless billing now!" is pretty common, especially when combined with some perk). Often these links use redirection to gauge effectiveness of the e-mail campaign, so it's common for the link to look strange. If the e-mail is a phishing attack, that redirection could include code injection resulting in you being sent to the right URL to login, but with malicious code inserted to capture credentials or do other fun and exciting things. Of course, the site would have to have some existing XSS vulnerability on the login page, or the code would have to be attacking a browser/plug-in vulnerability, for you to see the EV SSL indicator properly in the address bar. The last point is also usually mitigated by extensions like NoScript in Firefox.
  • jacquesm 16y ago
    Excellent rules and I really think those ought to be pasted to the front of every monitor of everybody that ever fell for a phishing scam, and preferably to the front of the monitors of those that have not yet fallen victim to one too.
  • meterplech 16y ago
    I was wondering about the no use of Mint. This post (by mint itself) says that they don't store passwords and only provide a read version of your data. http://satisfaction.mint.com/mint/topics/is_my_data_safe_with_mint http://satisfaction.mint.com/mint/topics/is_my_data_safe_wit... Could you/someone who has more knowledge of this than me explain how this is safer (if it is) and then possibly explain if/how someone could hack mint to get my information. I always thought of mint as just as safe as using online banking, is this very flawed?
    • abraham 16y ago
      Mint stores you passwords. As with anything you are increasing risk by adding a third party to the equation.
      • meterplech 16y ago
        Not sure how this works, but the way they describe it they say that they don't really store them, but your internet finance provider stores them and they only access via some credentialing. It does make sense that just adding someone to the equation adds more possibilities for risk
• MisterWebz 16y ago
  Sounds like this guy has way too much time on his hands. And what did you mean by "his theory"?
  • noodle 16y ago
    i think his theory is that HNers and redditors have a more elitist attitude about themselves and their tech skills, but will fall for the same basic traps as their grandma. (or, thats what it sounds like to me)
    • weaksauce 16y ago
      This community on average is more technical than most but that is just aggregate statistics. I would say that in any community you are going to get x% that would fall for a phishing scam.
      • noodle 16y ago
        oh, i mean, i agree. in school, i did a project in a network security class that involved phishing the network security class, and it had a roughly 50% success rate. if someone were to seriously try and phish any specific site, they'd probably be reasonably successful. the question really is, how long would it take for someone to recognize what was going on and get it killed? will 20 people visit the page, or will 2000?
        • MisterWebz 16y ago
          We already got a warning before (I assume) it happened, so I'm guessing it wouldn't take too long before we find out if something like that would occur. Or it might not even reach front page.
        • jacquesm 16y ago
          That was one of the questions we hoped to answer. It pleases me to say that in spite of it being an obvious 'fake' it didn't take mozilla more than a few hours to have the site marked as a phishing site, which I think is really great for them.
• micheljansen 16y ago
  Good idea, as long as it is only to demonstrate proof of concept (or in this case, opinion). Better be pointed to your own failures like this than wait for someone with more malicious intentions :)
• citricsquid 16y ago
  I assume his idea is "hey hackernews do you like my startup please sign up to try it out" and then (edit: after signing up) the login page will have a "server error" when you try to view the idea and that way he doesn't have to build a product and won't attract suspicion. "oh sorry you hammered my server, it'll be back later today".
  • tptacek 16y ago
    No, it's dumber than that.
  • reduxredacted 16y ago
    Wouldn't this be mitigated by not using the same login information on the startup site?
• levesque 16y ago
  Has 4chan got the black eye for HN/reddit?
• maxklein 16y ago
  Is the solution to all this not Facebook Connect and Google Login?
  • lonestar 16y ago
    No, indeed it is not. If the problem is that people are getting phished because they type their info into a spoofed login page, how would making one standard login page be the answer?
  • tallanvor 16y ago
    Well, I for one don't want all of my accounts linked together. I don't think that's information that Facebook or Google needs.
  • axod 16y ago
    Definitely! Lump all my logins into a single point of failure, so that if something is compromized, everything is!!! Awesome idea. :/
    • maxklein 16y ago
      It's also a single point to defend.
• swombat 16y ago
  So, wait a minute... jacquesm contacted you with an idea for a relatively harmless experiment (I was contacted too, so I know what it was about), and your response was to post it all on HN without even talking to him first?
  • wwortiz 16y ago
    It seems that icey did not think it was so harmless and wanted to inform the community in case any malice was involved. If this experiment was completely harmless I don't see why the contributor needed to contact so many people (as it seems they contacted quite a few active members from the comments) in order to perform it.
    • swombat 16y ago
      Knowing what the phishing in question was, yes, it was pretty harmless. Even if it was not, jacquesm would not risk his reputation in doing something malicious to the HN community, so this is a case where a private email might have done the same as this public notice. I'm not saying anyone here did anything terrible, but usually when contacted privately you first respond privately, so this is a bit out of order. It's not like jacquesm wouldn't have listened to arguments about this, and so an immediate action in the form of this post is, well, just bad form. Edit: jacquesm has come forth with it, so I've replaced "a contributor" with his username.
      • icey 16y ago
        I did respond in channel; I'm not sure what your problem is with that.
      • jasonlotito 16y ago
        > Even if it was not, jacquesm would not risk his reputation in doing something malicious to the HN community, Not intending to get into this specific debate, but that's precisely the wrong way to think. Well respected individuals with a good reputation risk their's every day. More importantly, for many, jacquesm is a faceless individual. How can you be certain he's the one who concocted this plan and it wasn't someone who fished out his information in order to utilize his reputation to gain something? Especially when this so-called "jacquesm" is trying to phish out information from the HN community, something that could hurt his reputation regardless of the intent. I'm not suggesting he wasn't who he said he was, nor should be distrust him. Rather, we need to always be aware of what we trust (and an email from a friend is merely that, an email, not your friend).
• rl1987 16y ago
  To avoid giving out too much information about myself on the web, I try to follow these rules: 1. Never give my actual name or address unless I'm intending to buy something. 2. Unless the website looks fairly reputable, I register with wh4f.org throw-away email account. 3. Third parties have no need to know any of my passwords. 4. Nigerian prime ministers don't contact random people on the internet.
• crocowhile 16y ago
  It has already happened on reddit last week. Someone came to /r/favors and offered a free premium account to a file hosting website he had just built. The deal was: you open an account on the website, you PM'me your username and I'll make it premium. Of course he got a load of users giving him data and then disappeared, along with the website. Any other "HN Rate my webapp" thread could do the same. There are ways of hashing nice password with custom-modified algorithms and bookmarklets. Use them guys.
• NathanKP 16y ago
  I don't think that it would be possible for me to fall for a HN phishing attack seeing as how I don't even have a password with HN. I logged in over a year ago using one click authentication linked to my Google account. The only way I could theoretically be effected by a phishing attack would be if the attacker somehow logged me out, then made a page which tricked me into thinking that I was clicking on HN's one click login.
• jacquesm 16y ago
  So, time to own up then, it seems the cat is firmly out of the bag, apparently icey thinks the chances of success are better than I do ;) The evil part in me could not help but wonder about how everybody seems to be so psyched about receiving a chrome notebook that they throw caution to the wind and enter anything and everything in to a form on some server somewhere allowing the google marketing department to significantly update their profiles with all that data they supply, and all that for the chance of getting a laptop. This sort of action is a very common marketing tactic, but I was actually quite surprised to see how popular it was on HN. Also, the fact that google was happy to collect your information even when you can't receive the notebook was an interesting detail, and lots of people only realized that after filling out the form. Then the other day a second thing happened, someone solved the contest that was embedded in the video that was used for the launch of the product. The evil part of me again thought wow, what a large amount of work that was done here, I wonder how people would respond to a second contest, with a much larger number of notebooks to be won? So, within a few minutes a plan was hatched, a simple idea to see how susceptible a security conscious community is to stuff like this. The domain is plainly in my name and just about all the tell tale signs of a phishing scam are present. Over the course of the last couple of days the text was polished to make it more clear what the intent is. The url of the site is http://www.freechromelaptop.com/ http://www.freechromelaptop.com/ , the url of the payoff page is http://www.freechromelaptop.com/process.html http://www.freechromelaptop.com/process.html Since I'm the main 'driver' behind this little prank I take full responsibility for it and for the fall-out if any, the other co-conspirators would have never done this without me asking for it. I hope you'll forgive me for having a devious side to me, but I intended for nothing but good to come out of this, and I hope that even if the project never got underway that you will take these words to heart, please be very careful with what you fill out in online forms, even if the page looks genuine and it is google that is giving you a chance to win some laptop you have to wonder if the collective value of the information given up does not exceed greatly the value of the goods they are shipping. Jacques
  • J3L2404 16y ago
    Results?
  • ScottWhigham 16y ago
• phpnode 16y ago
  Icey, I'm presuming you knew that the point of the plan was to educate and remind us all that we're not immune from this kind of thing. So it's quite clear jacquesm had no malice here, if he did do you think he'd discuss it so openly? Since you've come out and spoiled this quite valuable opportunity, do you believe your post is in any way more effective at communicating the message than submitting the fake phishing site would have been?
  • icey 16y ago
    That's how it's being spun now, and perhaps in the email that went out today that I have not been privy to (probably because I voiced my disagreement with the idea at the time). That's not how it was being discussed at the time.
    • jacquesm 16y ago
      Anybody that wants to check up on that, here is the chat log: http://www.freechromelaptop.com/irc.txt http://www.freechromelaptop.com/irc.txt This was in open channel on #startups, I've redacted the names of the other participants.
      • deleted 16y ago
        [deleted]
      • icey 16y ago
        This is missing parts of the conversation; but seriously Jacques, I've got no appetite for making this about you. We both agree that it's easy to phish people. I disagreed then and still disagree now that the right way to do that is to embarrass them. If I wanted to "shame" you somehow, I could have easily done that by naming names to begin with. The only intention of this submission was to warn people that you must be careful with your information because you never know who might be out to get it. I don't believe you were out to snag people's financial data, but beyond that it was pretty tough to tell what you were after other than "teaching other people a lesson" (yes, this is paraphrased). I fail to see what positive outcome could occur from essentially pointing and laughing at people because they fell for your scheme. [Edit: I did a bad and edited this comment. Originally it only said "This is missing parts of the conversation", which is what jacquesm is replying to.]
• x0ner 16y ago
  I can't say I see anything wrong with the crude learning lesson he was trying to put out there. I myself wrote a quick Wachovia Chrome Extension that never stored credentials, but tracked if someone actually put them in. Upon a "login" the user would be presented with a warning about the dangers of phishing and how to be safe. It blew my mind to see people actually writing comments telling me they tried to log in multiple times, but never had success. Sometimes learning the hard way is the only way. https://chrome.google.com/extensions/detail/pcgpfcjfajapillikcncobfmmjfapphn https://chrome.google.com/extensions/detail/pcgpfcjfajapilli...
• GHFigs 16y ago
  I don't want to be a part of a community where supposedly respectable members might try to phish me if they don't like my attitude. The particulars in this situation only keep me from being angry. Was it malicious or harmful? No. But is it irritating to know that crap like this going on and that I might be punished for not lurking the right IRC channels? Hell yeah. I don't need that kind of attention-theft in my life.