4 ms·

I suggest you go and talk to people outside your normal tech bubble. Recognising which parts of a URl mean what is tricky for most people. Here's some examples

by edent 7y ago

I suggest you go and talk to people outside your normal tech bubble. Recognising which parts of a URl mean what is tricky for most people. Here's some examples I've collected of people clicking on links in suspicious texts: https://twitter.com/edent/status/1193147685370552322 https://twitter.com/edent/status/1193147685370552322 https://twitter.com/edent/status/780317797855395841 https://twitter.com/edent/status/780317797855395841

hartator 7y ago
I don’t agree. We don’t school marketing people as a whole when people fall for pyramid schemes. Not sure why your average engineer should take the blame for scammer actions. Yes, life is hard and complicated. Tech is no exception.
- SahAssar 7y ago
  Nobody is saying to "blame" all engineers for these scams. But you make it seem like that URL would be immediately obvious for everyone, and that clearly isn't true.
brlewis 7y ago
Do you think browser makers should do more to distinguish the host part from the path part of a URL? Right now Firefox uses a darker color for the domain and Chrome uses a darker color for the full hostname.
- Nextgrid 7y ago
  I hate it how browsers always screw with how they display URLs. Some hide protocols, some hide the path, etc and the display of HTTPS is inconsistent. I could see this weird domain name being slightly confusing and looking like a full URL in a browser that normally hides the path part. It would be much easier if browsers just cut the crap and displayed the full URL (including the protocol) consistently. It's just one thing everyone can learn and then apply across all platforms & browsers.
  - saagarjha 7y ago
    URLs are long and they don’t consistently fit in the URL bar. You’re just trading one phishing mechanism for another, IMO worse, one.
Nextgrid 7y ago
Just because it happens doesn't mean there's something wrong with the technology. This is the real-life equivalent of walking into a shop that's branded "AyeAye" when paying your "EE" bill. There is nothing being exploited here like a display bug in the URL bar, TLS vulnerability, etc - it is completely obvious that you are not connecting to EE.co.uk and instead to some weird domain. There's only so much we can do to fix stupid and natural selection (or in this case financial selection) can take care of the rest. Banks refunding every instance of fraud (even when the user is obviously at fault and failed for an obvious scam) don't help either as it means people still don't understand the importance of being vigilant and actually taking the time to learn some basics in order not to fall for these very obvious scams.
- FDSGSG 7y ago
  >Just because it happens doesn't mean there's something wrong with the technology. This is the real-life equivalent of walking into a shop that's branded "AyeAye" when paying your "EE" bill. I would guess that if this scam was performed over snail mail it would have vastly higher success rates than SMS spam.

by edent 7y ago

hartator 7y ago

I don’t agree. We don’t school marketing people as a whole when people fall for pyramid schemes. Not sure why your average engineer should take the blame for scammer actions. Yes, life is hard and complicated. Tech is no exception.

SahAssar 7y ago
Nobody is saying to "blame" all engineers for these scams. But you make it seem like that URL would be immediately obvious for everyone, and that clearly isn't true.

brlewis 7y ago

Do you think browser makers should do more to distinguish the host part from the path part of a URL? Right now Firefox uses a darker color for the domain and Chrome uses a darker color for the full hostname.

Nextgrid 7y ago
I hate it how browsers always screw with how they display URLs. Some hide protocols, some hide the path, etc and the display of HTTPS is inconsistent. I could see this weird domain name being slightly confusing and looking like a full URL in a browser that normally hides the path part. It would be much easier if browsers just cut the crap and displayed the full URL (including the protocol) consistently. It's just one thing everyone can learn and then apply across all platforms & browsers.
- saagarjha 7y ago
  URLs are long and they don’t consistently fit in the URL bar. You’re just trading one phishing mechanism for another, IMO worse, one.

Nextgrid 7y ago

Just because it happens doesn't mean there's something wrong with the technology. This is the real-life equivalent of walking into a shop that's branded "AyeAye" when paying your "EE" bill. There is nothing being exploited here like a display bug in the URL bar, TLS vulnerability, etc - it is completely obvious that you are not connecting to EE.co.uk and instead to some weird domain. There's only so much we can do to fix stupid and natural selection (or in this case financial selection) can take care of the rest. Banks refunding every instance of fraud (even when the user is obviously at fault and failed for an obvious scam) don't help either as it means people still don't understand the importance of being vigilant and actually taking the time to learn some basics in order not to fall for these very obvious scams.

FDSGSG 7y ago
>Just because it happens doesn't mean there's something wrong with the technology. This is the real-life equivalent of walking into a shop that's branded "AyeAye" when paying your "EE" bill. I would guess that if this scam was performed over snail mail it would have vastly higher success rates than SMS spam.