5 ms·

Anyone can get phished if, on an off day when you're tired or distracted by personal issues or whatever, your guard is down and you happen to receive a phishing

Anyone can get phished if, on an off day when you're tired or distracted by personal issues or whatever, your guard is down and you happen to receive a phishing attempt that also pattern matches something you're kind of expecting, either because it's a targeted attempt or just randomly for a wide-net phishing attempt. That's my model of how phishing works, they just make lots of attempts and know they will get lucky some small percentage of the time. With that as my model: the email getting to your inbox is of course the first failure and increases the chance of getting phished from zero to not zero. Opening the email is another failure that raises the chance. Clicking the link is another. All of the steps leading up to entering credentials or downloading and executing something from a phishing site is a real failure in that it increases the chances of becoming compromised. That's even true if you're suspicious the whole way through. If you know it's a phishing attempt and are investigating, fine. But if you are suspicious, that means you can still go either way. You can also get distracted and end up with the phishing link in some tab waiting for you to return to it with all the contextual clues missing.

phire 6y ago
Someone once posted a link on hackernews titled "new phishing attack uses google domain to look legit" I opened it in a new tab along with several other links to read, I was expecting a nice blog post explaining an exploit. After about 20min of reading the other tabs I came across that tab again. I had forgotten the title of what I had clicked, I'm not sure I even remembered it was a hackernews link that got me to that page. "Oh, looks like Google has randomly logged me out, that doesn't happen often" I think as I instinctively enter my email and password and hit enter. Followed half a second later by "oh shit, that wasn't a legitimate google login prompt." I raced off to quickly change my password, kick off any unknown IPs and make sure nothing had changed in my email configuration. I'm lucky I came to my senses quickly. I think it was the redirect to generic google home page that made me click, along with the memory of the phishing related link I had clicked 20min ago. But yeah, it can happen to anyone on a bad day.
- PowerfulWizard 6y ago
  There should really be a browser-managed 'tainted' flag on any tab opened from an email that prevents password input. Or if not prevents, at least a scary warning click through like an unsigned certificate creates, which at least shows the true full domain name. Whenever it read about phishing it seems insane we have a system that requires human judgement for this task. If there isn't a deterministic strategy to detect it, how could the user ever reliably succeed? And if there is such a strategy, it should be done by the mail server, mail client, and browser. Even an extension doing this might work in a corporate context. That makes me wonder if companies do their own extensions to enhance the browser for their needs. If all your employees are using web browsers for multiple hours per day it might really be worth it.
  - esnard 6y ago
    Any new constraint on password inputs will result in attackers creating a fake password input without any constraint, via CSS / JS.
    - amelius 6y ago
      But an AI in the browser could detect this and warn the user.
      - therein 6y ago
        So we are throwing machine learning at the problem because we can't come up with the heuristics for this ourselves?
        amelius 6y ago
        Machine learning is being used in spam filters, so why not use it for this problem too?
        web007 6y ago
        Yes? That's exactly what it's for: finding patterns that are too hard or too complex for humans to find. Enumerating every edge case of "enter a password" is not possible for a human, and whatever edge cases we humans miss _will_ be exploited by someone to compromise someone else. It's also a matter of volume. How many pages can you evaluate and categorize in an hour versus how many can a ML system do in the same? I once saw a demo where a firewall/virus scanner app could detect malware heuristics dynamically by comparing to a baseline system, and could do so in 10 seconds or less per item. It would take a human more than 10 seconds just to read the report to generate a rule, and humans don't scale nearly well enough. There are lots of complaints to be had about ML and privacy / fairness / ethics / effectiveness, but this shouldn't be one of them.
lucb1e 6y ago
I just realized that this might happen to me. On my home PC my alarm bells would definitely go off when Firefox stops suggesting credentials for a supposedly known domain, but on my work computer we're a bit higher security and a password manager integrated into the browser (even with master password and quickly installing patches and whatnot) is just not up to scratch. So what I realized is that I may not notice a lookalike domain because I need to grab the creds from another program anyway. Is there an add-on for Firefox that warns when you enter credentials on a new domain? Or puts a warning triangle in a password field when today is the first day you visited the domain or something? Firefox already tracks the latter, you can see it in the page info screen, so both should be easy to make but I'm not sure anyone thought of making this before.
hn_throwaway_99 6y ago
This is exactly why security keys should become standard. They are essentially unphishable.
- amelius 6y ago
  I really don't understand why every laptop/computer/keyboard/smartwatch doesn't come with NFC for exactly this purpose.
pdonis 6y ago
> Anyone can get phished if, on an off day when you're tired or distracted by personal issues or whatever It shouldn't matter how tired or distracted you are: you should never enter credentials into any place you get to from anything you receive in an email--or indeed by any channel that you did not initiate yourself. If you get an email that claims there is some work IT issue you need to resolve, you call your work IT department yourself to ask them what's going on; you don't enter credentials into a website you got to from a link in the email. It's the same rule you should apply to attempted phone call scams: never give any information to someone who calls you; instead, end the call and initiate another call yourself to a number you know to see if there is actually a legitimate issue you need to deal with. Rules like this should be ingrained in you to the point where you follow them even when you're tired or distracted, like muscle memory.

phire 6y ago

Someone once posted a link on hackernews titled "new phishing attack uses google domain to look legit" I opened it in a new tab along with several other links to read, I was expecting a nice blog post explaining an exploit. After about 20min of reading the other tabs I came across that tab again. I had forgotten the title of what I had clicked, I'm not sure I even remembered it was a hackernews link that got me to that page. "Oh, looks like Google has randomly logged me out, that doesn't happen often" I think as I instinctively enter my email and password and hit enter. Followed half a second later by "oh shit, that wasn't a legitimate google login prompt." I raced off to quickly change my password, kick off any unknown IPs and make sure nothing had changed in my email configuration. I'm lucky I came to my senses quickly. I think it was the redirect to generic google home page that made me click, along with the memory of the phishing related link I had clicked 20min ago. But yeah, it can happen to anyone on a bad day.

PowerfulWizard 6y ago
There should really be a browser-managed 'tainted' flag on any tab opened from an email that prevents password input. Or if not prevents, at least a scary warning click through like an unsigned certificate creates, which at least shows the true full domain name. Whenever it read about phishing it seems insane we have a system that requires human judgement for this task. If there isn't a deterministic strategy to detect it, how could the user ever reliably succeed? And if there is such a strategy, it should be done by the mail server, mail client, and browser. Even an extension doing this might work in a corporate context. That makes me wonder if companies do their own extensions to enhance the browser for their needs. If all your employees are using web browsers for multiple hours per day it might really be worth it.
- esnard 6y ago
  Any new constraint on password inputs will result in attackers creating a fake password input without any constraint, via CSS / JS.
  - amelius 6y ago
    But an AI in the browser could detect this and warn the user.
    - therein 6y ago
      So we are throwing machine learning at the problem because we can't come up with the heuristics for this ourselves?
      - amelius 6y ago
        Machine learning is being used in spam filters, so why not use it for this problem too?
      - web007 6y ago
        Yes? That's exactly what it's for: finding patterns that are too hard or too complex for humans to find. Enumerating every edge case of "enter a password" is not possible for a human, and whatever edge cases we humans miss _will_ be exploited by someone to compromise someone else. It's also a matter of volume. How many pages can you evaluate and categorize in an hour versus how many can a ML system do in the same? I once saw a demo where a firewall/virus scanner app could detect malware heuristics dynamically by comparing to a baseline system, and could do so in 10 seconds or less per item. It would take a human more than 10 seconds just to read the report to generate a rule, and humans don't scale nearly well enough. There are lots of complaints to be had about ML and privacy / fairness / ethics / effectiveness, but this shouldn't be one of them.

lucb1e 6y ago

I just realized that this might happen to me. On my home PC my alarm bells would definitely go off when Firefox stops suggesting credentials for a supposedly known domain, but on my work computer we're a bit higher security and a password manager integrated into the browser (even with master password and quickly installing patches and whatnot) is just not up to scratch. So what I realized is that I may not notice a lookalike domain because I need to grab the creds from another program anyway. Is there an add-on for Firefox that warns when you enter credentials on a new domain? Or puts a warning triangle in a password field when today is the first day you visited the domain or something? Firefox already tracks the latter, you can see it in the page info screen, so both should be easy to make but I'm not sure anyone thought of making this before.

hn_throwaway_99 6y ago

This is exactly why security keys should become standard. They are essentially unphishable.

amelius 6y ago
I really don't understand why every laptop/computer/keyboard/smartwatch doesn't come with NFC for exactly this purpose.

pdonis 6y ago

> Anyone can get phished if, on an off day when you're tired or distracted by personal issues or whatever It shouldn't matter how tired or distracted you are: you should never enter credentials into any place you get to from anything you receive in an email--or indeed by any channel that you did not initiate yourself. If you get an email that claims there is some work IT issue you need to resolve, you call your work IT department yourself to ask them what's going on; you don't enter credentials into a website you got to from a link in the email. It's the same rule you should apply to attempted phone call scams: never give any information to someone who calls you; instead, end the call and initiate another call yourself to a number you know to see if there is actually a legitimate issue you need to deal with. Rules like this should be ingrained in you to the point where you follow them even when you're tired or distracted, like muscle memory.