6 ms·

Not only that. On mobile, it meant that AMP delivered pages by google's domain were stripped out in a way that the publisher's domain was displayed, effectively

Not only that. On mobile, it meant that AMP delivered pages by google's domain were stripped out in a way that the publisher's domain was displayed, effectively MITMing the website from a user's point of view. Maybe the next iteration of it will use SSL certificate hijacking, who knows? I mean, this feature can be argued with from both sides: protection against scam and "UX MITM". What I don't understand is why a web browser doesn't already include scam websites into their malware/badware reporting feature. It could have been so much easier. In Germany we have a very restrictive law when it comes to imprints on websites, which makes it easy to spot scamming websites if you care to look for the legibility of the imprint (and required tax law identification numbers). Of course that doesn't apply for international law, but initially I didn't understand the importance of it...meanwhile I do.

Case81 5y ago
“UX MITM” is the funniest thing I’ve heard all week
- cookiengineer 5y ago
  I don't even know how to call this to be honest. I mean, it's not scam, it's not MITM, it's not fraud but it's still trying to deceive users...so what is it? The only parallel that comes to mind are all the "helpful" clickjacking toolbars in Internet Explorer that tried to push every search and every link to their own results page.
  - matt_kantor 5y ago
    "Dark pattern" fits, but is not very specific.
serial_dev 5y ago
I don't understand how the imprints on websites help with scams. Could you elaborate? If someone is scamming people, it wouldn't be too surprising if they do include the imprint or include incorrect data there, wouldn't it?
- cookiengineer 5y ago
  > I don't understand how the imprints on websites help with scams. Could you elaborate? In imprints there's an address that you can lookup on the Handelsregister. If the HRB matches, and the Handelsregister's Domain for the company matches, too... it's usually an indicator that the website is trustworthy (at least from a legal sue-able-in-case-of-fraud standpoint). Example (never used the website before): - https://www.deerberg.de/service/impressum https://www.deerberg.de/service/impressum - Northdata.de entry checks out (public webservice of Handelsregister entries), with same domain(s) - unternehmen24.info checks out (another public webservice of Handelsregister entries), with same domain(s) - HRB checks out, it's in Lueneburg - DNS records and whois point out it's locally hosted in Lueneburg, too. - Googled Umsatzsteuer-ID, no other (unrelated, scammy looking domain) results - Googled HRB, checks out as well - Google Business Page on Google Maps checks out as well (which might be hijacked, so not trustworthy as indicator alone) - Geschaeftsfuehrer check out as well So yeah, I guess this page/company is legit. You could do this further with LinkedIn and other things like looking up phone numbers in Breaches/Leaks and match the records with the Handelsregister. From an automation perspective this is still a lot of manual research that's necessary; and I guess that this is kind of the real issue at hand - that most people are too lazy to do this sort of background check before they buy something online. But I guess depending on the financial value you're willing to spend some background check beforehand makes more sense if a fraud would financially burden your means of survival afterwards.
  - logifail 5y ago
    > that most people are too lazy to do this sort of background check before they buy something online To be honest that does seem like an awful lot of detective work especially if this would be for a simple online purchase, particularly if the transaction value isn't that high. In many countries you would typically pay online using a credit card or Paypal in which case the card issuer/bank/Paypal provides you with a degree of protection if a product doesn't turn up or isn't what you ordered. In Germany I believe people still are used to there being the option to pay using "Vorkasse" (paying in advance, by bank transfer). I've simply never understood why any buyer would want to assume all the risk by doing that.

Case81 5y ago

“UX MITM” is the funniest thing I’ve heard all week

cookiengineer 5y ago
I don't even know how to call this to be honest. I mean, it's not scam, it's not MITM, it's not fraud but it's still trying to deceive users...so what is it? The only parallel that comes to mind are all the "helpful" clickjacking toolbars in Internet Explorer that tried to push every search and every link to their own results page.
- matt_kantor 5y ago
  "Dark pattern" fits, but is not very specific.

serial_dev 5y ago

I don't understand how the imprints on websites help with scams. Could you elaborate? If someone is scamming people, it wouldn't be too surprising if they do include the imprint or include incorrect data there, wouldn't it?

cookiengineer 5y ago
> I don't understand how the imprints on websites help with scams. Could you elaborate? In imprints there's an address that you can lookup on the Handelsregister. If the HRB matches, and the Handelsregister's Domain for the company matches, too... it's usually an indicator that the website is trustworthy (at least from a legal sue-able-in-case-of-fraud standpoint). Example (never used the website before): - https://www.deerberg.de/service/impressum https://www.deerberg.de/service/impressum - Northdata.de entry checks out (public webservice of Handelsregister entries), with same domain(s) - unternehmen24.info checks out (another public webservice of Handelsregister entries), with same domain(s) - HRB checks out, it's in Lueneburg - DNS records and whois point out it's locally hosted in Lueneburg, too. - Googled Umsatzsteuer-ID, no other (unrelated, scammy looking domain) results - Googled HRB, checks out as well - Google Business Page on Google Maps checks out as well (which might be hijacked, so not trustworthy as indicator alone) - Geschaeftsfuehrer check out as well So yeah, I guess this page/company is legit. You could do this further with LinkedIn and other things like looking up phone numbers in Breaches/Leaks and match the records with the Handelsregister. From an automation perspective this is still a lot of manual research that's necessary; and I guess that this is kind of the real issue at hand - that most people are too lazy to do this sort of background check before they buy something online. But I guess depending on the financial value you're willing to spend some background check beforehand makes more sense if a fraud would financially burden your means of survival afterwards.
- logifail 5y ago
  > that most people are too lazy to do this sort of background check before they buy something online To be honest that does seem like an awful lot of detective work especially if this would be for a simple online purchase, particularly if the transaction value isn't that high. In many countries you would typically pay online using a credit card or Paypal in which case the card issuer/bank/Paypal provides you with a degree of protection if a product doesn't turn up or isn't what you ordered. In Germany I believe people still are used to there being the option to pay using "Vorkasse" (paying in advance, by bank transfer). I've simply never understood why any buyer would want to assume all the risk by doing that.