4 ms·

> Luckily, she's not with EE - because it's a pretty convincing text. Not it’s not. billing-jan-2020.info looks suspicious as hell. Recognizing domain names fr

> Luckily, she's not with EE - because it's a pretty convincing text. Not it’s not. billing-jan-2020.info looks suspicious as hell. Recognizing domain names from url is very 101 Internet security.

edent 7y ago
I suggest you go and talk to people outside your normal tech bubble. Recognising which parts of a URl mean what is tricky for most people. Here's some examples I've collected of people clicking on links in suspicious texts: https://twitter.com/edent/status/1193147685370552322 https://twitter.com/edent/status/1193147685370552322 https://twitter.com/edent/status/780317797855395841 https://twitter.com/edent/status/780317797855395841
- hartator 7y ago
  I don’t agree. We don’t school marketing people as a whole when people fall for pyramid schemes. Not sure why your average engineer should take the blame for scammer actions. Yes, life is hard and complicated. Tech is no exception.
  - SahAssar 7y ago
    Nobody is saying to "blame" all engineers for these scams. But you make it seem like that URL would be immediately obvious for everyone, and that clearly isn't true.
- brlewis 7y ago
  Do you think browser makers should do more to distinguish the host part from the path part of a URL? Right now Firefox uses a darker color for the domain and Chrome uses a darker color for the full hostname.
  - Nextgrid 7y ago
    I hate it how browsers always screw with how they display URLs. Some hide protocols, some hide the path, etc and the display of HTTPS is inconsistent. I could see this weird domain name being slightly confusing and looking like a full URL in a browser that normally hides the path part. It would be much easier if browsers just cut the crap and displayed the full URL (including the protocol) consistently. It's just one thing everyone can learn and then apply across all platforms & browsers.
    - saagarjha 7y ago
      URLs are long and they don’t consistently fit in the URL bar. You’re just trading one phishing mechanism for another, IMO worse, one.
- Nextgrid 7y ago
  Just because it happens doesn't mean there's something wrong with the technology. This is the real-life equivalent of walking into a shop that's branded "AyeAye" when paying your "EE" bill. There is nothing being exploited here like a display bug in the URL bar, TLS vulnerability, etc - it is completely obvious that you are not connecting to EE.co.uk and instead to some weird domain. There's only so much we can do to fix stupid and natural selection (or in this case financial selection) can take care of the rest. Banks refunding every instance of fraud (even when the user is obviously at fault and failed for an obvious scam) don't help either as it means people still don't understand the importance of being vigilant and actually taking the time to learn some basics in order not to fall for these very obvious scams.
  - FDSGSG 7y ago
    >Just because it happens doesn't mean there's something wrong with the technology. This is the real-life equivalent of walking into a shop that's branded "AyeAye" when paying your "EE" bill. I would guess that if this scam was performed over snail mail it would have vastly higher success rates than SMS spam.
msinclair 7y ago
Tell that to the any number of people that have fallen for similar (or even more basic) scams. Unfortunately, not everyone is Internet savvy enough to know what's legitimate and what's a scam.
- andai 7y ago
  A good deal of that same group can get scammed over the phone. The issue doesn't seem to be so much about specific technology. Granted, domains are "backwards", and browsers could be made to match known banking sites against every URL to warn of scams. But at the point where people are clicking scammy bit.ly links too, the domain part doesn't seem to be so key anymore. In HTML (emails) you can make the url look like the real thing onscreen. Should GMail alert when anchor text is a different link than it actually links to? (Maybe it already does?)

> Luckily, she's not with EE - because it's a pretty convincing text. Not it’s not. billing-jan-2020.info looks suspicious as hell. Recognizing domain names from url is very 101 Internet security.

edent 7y ago

I suggest you go and talk to people outside your normal tech bubble. Recognising which parts of a URl mean what is tricky for most people. Here's some examples I've collected of people clicking on links in suspicious texts: https://twitter.com/edent/status/1193147685370552322 https://twitter.com/edent/status/1193147685370552322 https://twitter.com/edent/status/780317797855395841 https://twitter.com/edent/status/780317797855395841

hartator 7y ago
I don’t agree. We don’t school marketing people as a whole when people fall for pyramid schemes. Not sure why your average engineer should take the blame for scammer actions. Yes, life is hard and complicated. Tech is no exception.
- SahAssar 7y ago
  Nobody is saying to "blame" all engineers for these scams. But you make it seem like that URL would be immediately obvious for everyone, and that clearly isn't true.
brlewis 7y ago
Do you think browser makers should do more to distinguish the host part from the path part of a URL? Right now Firefox uses a darker color for the domain and Chrome uses a darker color for the full hostname.
- Nextgrid 7y ago
  I hate it how browsers always screw with how they display URLs. Some hide protocols, some hide the path, etc and the display of HTTPS is inconsistent. I could see this weird domain name being slightly confusing and looking like a full URL in a browser that normally hides the path part. It would be much easier if browsers just cut the crap and displayed the full URL (including the protocol) consistently. It's just one thing everyone can learn and then apply across all platforms & browsers.
  - saagarjha 7y ago
    URLs are long and they don’t consistently fit in the URL bar. You’re just trading one phishing mechanism for another, IMO worse, one.
Nextgrid 7y ago
Just because it happens doesn't mean there's something wrong with the technology. This is the real-life equivalent of walking into a shop that's branded "AyeAye" when paying your "EE" bill. There is nothing being exploited here like a display bug in the URL bar, TLS vulnerability, etc - it is completely obvious that you are not connecting to EE.co.uk and instead to some weird domain. There's only so much we can do to fix stupid and natural selection (or in this case financial selection) can take care of the rest. Banks refunding every instance of fraud (even when the user is obviously at fault and failed for an obvious scam) don't help either as it means people still don't understand the importance of being vigilant and actually taking the time to learn some basics in order not to fall for these very obvious scams.
- FDSGSG 7y ago
  >Just because it happens doesn't mean there's something wrong with the technology. This is the real-life equivalent of walking into a shop that's branded "AyeAye" when paying your "EE" bill. I would guess that if this scam was performed over snail mail it would have vastly higher success rates than SMS spam.

msinclair 7y ago

Tell that to the any number of people that have fallen for similar (or even more basic) scams. Unfortunately, not everyone is Internet savvy enough to know what's legitimate and what's a scam.

andai 7y ago
A good deal of that same group can get scammed over the phone. The issue doesn't seem to be so much about specific technology. Granted, domains are "backwards", and browsers could be made to match known banking sites against every URL to warn of scams. But at the point where people are clicking scammy bit.ly links too, the domain part doesn't seem to be so key anymore. In HTML (emails) you can make the url look like the real thing onscreen. Should GMail alert when anchor text is a different link than it actually links to? (Maybe it already does?)