4 ms·
> just by reading the domain itself Its easy to overlook that. Thinking its safe to click on www.google.com... while the full domain is actually www.google.com
by orangepanda 5y ago
> just by reading the domain itself
Its easy to overlook that. Thinking its safe to click on www.google.com... while the full domain is actually www.google.com.example.com
- hnbad 5y agoThe comment you are replying to was mostly about meatspace. You don't click links in meatspace, you type them into your browser by hand. The threat scenario of someone putting a malicious URL on an official-looking document is distinct from someone putting a malicious QR code on an official-looking document as the latter allows all the same malicious URL techniques that work for links while the former involves a human typing out the URL in full (and thus either auto-correcting intentional "typos" or at least having a chance to notice them). In other words: QR codes allow link spoofing in meatspace. Even if you understand phishing, you might not think to verify that the official looking document with a QR code on it placed in or on the associated official building might be a trap. The mitigation required for this threat scenario is more akin to securing an ATM.
- ajsnigrutin 5y agoYes, but if it's just written somewhere, you have to type that in manually, so you notice something strange while typing the suspiciously long url. With qr codes, it scans in a second, and it's easier to miss it, especially if the qr reader automatically opens the url.
- deleted 5y ago[deleted]
- davchana 5y agoExactly. One of the scam email I received had domain microsoft.com-online.top/review