8 ms·

How on Earth is "Offered by: Microsoft Corporation" not verified in literally any way whatsoever. That's so poorly vetted it's negligent. Maybe extensions and

How on Earth is "Offered by: Microsoft Corporation" not verified in literally any way whatsoever. That's so poorly vetted it's negligent. Maybe extensions and apps should be signed by domain ownership?

yrro 5y ago
In general this is a good idea. But in the case of Microsoft--good luck figuring out which of Microsoft's thousands of domains are legit! :)
- koheripbal 5y ago
  It would seem to me that Microsoft would choose to link it to microsoft.com so that customers can easily recognize its authenticity.
  - yrro 5y ago
    They have already failed this test: they are already publishing extensions using msftliveapps@gmail.com and msandapp.bgcextn@gmail.com, doubtless many others!
    - evilsnoopi3 5y ago
      I believe Google requires you publish Chrome extensions with an @gmail address, in which case MS doesn’t really have a choice.
      - yrro 5y ago
        Good grief--that is so evil (not to mention anticompetitive) that I didn't even consider it!
        deleted 5y ago
        [deleted]
        Godel_unicode 5y ago
        Not sure what would make using a Gmail account anticompetitive, but it's also not true. You need a chrome web store account (which they amusingly encourage you not to use your personal email for) which can use any email address.
      - criddell 5y ago
        Any idea what problem Google is solving by requiring the use of gmail?
        nolok 5y ago
        Naivety on the internet, and people believing what they read on a web page without checking. Google doesn't require a gmail adresse to publish.
        criddell 5y ago
        Yeah, I didn't think it made sense.
      - electroly 5y ago
        Absolutely untrue, as mentioned elsewhere in the thread. I have Chrome extensions published under a non-gmail email address.
  - dragonwriter 5y ago
    Microsoft might, I suppose, have a policy against microsoft.com accounts on other firms infrastructure, and therefore if it needs a Google account uses gmail or other non-microsoft.com domains.
- formerly_proven 5y ago
  Reminds me of Paypal where I'm simply unable to tell whether some mails from them were phishing or not (regardless of time spent investigating these mails), and I believe that virtually no one would be able to tell.
  - ComputerGuru 5y ago
    They were even cognizant of the issue to the point where they set up a robo inbox you could forward any suspected phishing emails to and it would reply telling you if it was legit or not. It was something like phishing@paypal.com
  - rocqua 5y ago
    It still frustrates me that legitimate Paypal e-mails include really big "click here to login" buttons that link you to their website. Such links are considered a hallmark of phishing, and there are many attempts to prevent people from clicking on such links. Many services I use include text like 'we will never send you such a link you know how to get to our website'. The fact that paypal does not do this normalizes clicking on links in e-mails.
    - gowld 5y ago
      "use email for notifications, but don't trust email content" is not a solution for most users. If you can't trust email, why even have it? Install a secure app and leave email behind, or make email secure by having clients clearly display cryptographically secured provenance info, and flag unknown/untrusted senders.
      - rocqua 5y ago
        There is no alternative to e-mail. Except perhaps for SMS. There is no other method for contacting people that is anywhere near as pervasive. It also has the advantage of being federated, not controlled by any specific entity. Besides that, compared to WhatsApp and signal, email is generally for longer and less urgent messages. Those fit notifications much better. In that context an email saying "hey this is whats up, login as you normally do if you want to verify or act accordingly". It's far from ideal. We will probably come to some form of solution at some point. But at this moment it is a clear no-brainer.
donmcronald 5y ago
It might be legit. The Microsoft rewards app uses msandapp.bgcextn@gmail.com. I’m guessing 1 million installs makes that legit. There’s no way even for technical people to make a proper assessment of the trustworthiness of the publisher. Google has ruined the internet because they want Google Search to be the only “trustworthy” source online. Too bad they suck at it and Google search is a steaming pile of shit now.
- estaseuropano 5y ago
  1 million click farmers in china/India/Nigeria?
scoopertrooper 5y ago
That one is legit, I'm guessing Chrome requires users to use a gmail account in order to submit an extension to their store. https://blogs.windows.com/windowsexperience/2021/02/05/simplify-and-secure-your-life-with-microsofts-autofill-solution-for-passwords/ https://blogs.windows.com/windowsexperience/2021/02/05/simpl...
- donmcronald 5y ago
  Talk about training users to fall for phishing schemes. Plus users have been so desensitized to entering 2FA codes they’ll type them in anywhere. I feel like web security is worse than it was 10 years ago.
  - thefounder 5y ago
    We need webauthn not just 2FA
    - throwawayboise 5y ago
      Love how the goalposts keep moving. First arcane password rules so it takes 5 minutes and half a dozen attempts to come up with a password that is accepted. Then force the user to change it often. Then add email verification. Then SMS/phone verification. Still not good enough, now we all need to have a hardware token to buy the counterfeit garbage for sale on Amazon. Fuck that. It's just not worth the trouble. Honestly the world was a lot easier (if a bit slower) when you dealt with businesses in person or via mail. Fraud and identity theft just doesn't scale in meatspace, so it was never a big problem.
      - moshmosh 5y ago
        I maintain that most of what we get from the Web and computers, as individuals, is barely better than what we had before, and not enough so to justify its costs. Shopping very much included. For some context, I grew up very much "OMG wire my brain in, let's get this future shit going!" Years of watching that future develop, and some reflection, have almost entirely reversed that sentiment, for me. For example: are streaming services convenient? Yeah, of course. Am I actually happier with them than I was with the library, rentals, and the occasional purchased movie? Marginally, if at all. (but I have Internet service for the handful of things it actually is highly beneficial for, so, may as well use streaming, too) Is shopping online convenient? Yes. Am I happier than when I just had way less idea what was available to buy, and there was more friction to indulging every little purchase-whim? I really wonder. This one may not just be marginally better, but net-harmful.
social_quotient 5y ago
Considering APPLE goes so far to make you confirm DUNS numbers for a company acct. It seems like this would have been a good mitigating practice and already has precedence. While it’s a PITA it makes sense.
- ocdtrekkie 5y ago
  The core issue is that Apple uses humans to evaluate these requests and provide a point of contact with businesses. Google believes any process requiring a human is broken.

yrro 5y ago

In general this is a good idea. But in the case of Microsoft--good luck figuring out which of Microsoft's thousands of domains are legit! :)

koheripbal 5y ago
It would seem to me that Microsoft would choose to link it to microsoft.com so that customers can easily recognize its authenticity.
- yrro 5y ago
  They have already failed this test: they are already publishing extensions using msftliveapps@gmail.com and msandapp.bgcextn@gmail.com, doubtless many others!
  - evilsnoopi3 5y ago
    I believe Google requires you publish Chrome extensions with an @gmail address, in which case MS doesn’t really have a choice.
    - yrro 5y ago
      Good grief--that is so evil (not to mention anticompetitive) that I didn't even consider it!
      - deleted 5y ago
        [deleted]
      - Godel_unicode 5y ago
        Not sure what would make using a Gmail account anticompetitive, but it's also not true. You need a chrome web store account (which they amusingly encourage you not to use your personal email for) which can use any email address.
    - criddell 5y ago
      Any idea what problem Google is solving by requiring the use of gmail?
      - nolok 5y ago
        Naivety on the internet, and people believing what they read on a web page without checking. Google doesn't require a gmail adresse to publish.
        criddell 5y ago
        Yeah, I didn't think it made sense.
    - electroly 5y ago
      Absolutely untrue, as mentioned elsewhere in the thread. I have Chrome extensions published under a non-gmail email address.
- dragonwriter 5y ago
  Microsoft might, I suppose, have a policy against microsoft.com accounts on other firms infrastructure, and therefore if it needs a Google account uses gmail or other non-microsoft.com domains.
formerly_proven 5y ago
Reminds me of Paypal where I'm simply unable to tell whether some mails from them were phishing or not (regardless of time spent investigating these mails), and I believe that virtually no one would be able to tell.
- ComputerGuru 5y ago
  They were even cognizant of the issue to the point where they set up a robo inbox you could forward any suspected phishing emails to and it would reply telling you if it was legit or not. It was something like phishing@paypal.com
- rocqua 5y ago
  It still frustrates me that legitimate Paypal e-mails include really big "click here to login" buttons that link you to their website. Such links are considered a hallmark of phishing, and there are many attempts to prevent people from clicking on such links. Many services I use include text like 'we will never send you such a link you know how to get to our website'. The fact that paypal does not do this normalizes clicking on links in e-mails.
  - gowld 5y ago
    "use email for notifications, but don't trust email content" is not a solution for most users. If you can't trust email, why even have it? Install a secure app and leave email behind, or make email secure by having clients clearly display cryptographically secured provenance info, and flag unknown/untrusted senders.
    - rocqua 5y ago
      There is no alternative to e-mail. Except perhaps for SMS. There is no other method for contacting people that is anywhere near as pervasive. It also has the advantage of being federated, not controlled by any specific entity. Besides that, compared to WhatsApp and signal, email is generally for longer and less urgent messages. Those fit notifications much better. In that context an email saying "hey this is whats up, login as you normally do if you want to verify or act accordingly". It's far from ideal. We will probably come to some form of solution at some point. But at this moment it is a clear no-brainer.

donmcronald 5y ago

It might be legit. The Microsoft rewards app uses msandapp.bgcextn@gmail.com. I’m guessing 1 million installs makes that legit. There’s no way even for technical people to make a proper assessment of the trustworthiness of the publisher. Google has ruined the internet because they want Google Search to be the only “trustworthy” source online. Too bad they suck at it and Google search is a steaming pile of shit now.

estaseuropano 5y ago
1 million click farmers in china/India/Nigeria?

scoopertrooper 5y ago

That one is legit, I'm guessing Chrome requires users to use a gmail account in order to submit an extension to their store. https://blogs.windows.com/windowsexperience/2021/02/05/simplify-and-secure-your-life-with-microsofts-autofill-solution-for-passwords/ https://blogs.windows.com/windowsexperience/2021/02/05/simpl...

donmcronald 5y ago
Talk about training users to fall for phishing schemes. Plus users have been so desensitized to entering 2FA codes they’ll type them in anywhere. I feel like web security is worse than it was 10 years ago.
- thefounder 5y ago
  We need webauthn not just 2FA
  - throwawayboise 5y ago
    Love how the goalposts keep moving. First arcane password rules so it takes 5 minutes and half a dozen attempts to come up with a password that is accepted. Then force the user to change it often. Then add email verification. Then SMS/phone verification. Still not good enough, now we all need to have a hardware token to buy the counterfeit garbage for sale on Amazon. Fuck that. It's just not worth the trouble. Honestly the world was a lot easier (if a bit slower) when you dealt with businesses in person or via mail. Fraud and identity theft just doesn't scale in meatspace, so it was never a big problem.
    - moshmosh 5y ago
      I maintain that most of what we get from the Web and computers, as individuals, is barely better than what we had before, and not enough so to justify its costs. Shopping very much included. For some context, I grew up very much "OMG wire my brain in, let's get this future shit going!" Years of watching that future develop, and some reflection, have almost entirely reversed that sentiment, for me. For example: are streaming services convenient? Yeah, of course. Am I actually happier with them than I was with the library, rentals, and the occasional purchased movie? Marginally, if at all. (but I have Internet service for the handful of things it actually is highly beneficial for, so, may as well use streaming, too) Is shopping online convenient? Yes. Am I happier than when I just had way less idea what was available to buy, and there was more friction to indulging every little purchase-whim? I really wonder. This one may not just be marginally better, but net-harmful.

social_quotient 5y ago

Considering APPLE goes so far to make you confirm DUNS numbers for a company acct. It seems like this would have been a good mitigating practice and already has precedence. While it’s a PITA it makes sense.

ocdtrekkie 5y ago
The core issue is that Apple uses humans to evaluate these requests and provide a point of contact with businesses. Google believes any process requiring a human is broken.