4 ms·
We really need a better system for knowing the authenticity of these settlement web sites. Right now we get some special web site that's like FooCompanyBarIssu
by adrianmonk 4y ago
We really need a better system for knowing the authenticity of these settlement web sites.
Right now we get some special web site that's like FooCompanyBarIssueSettlement.com, which is descriptive, but how do we know it's not some phishing site?
The site itself always says it's the official site and gives a case number, but there's nothing stopping a fake site from doing those things.
Right now we have to rely on it being reported in the media[1]. That's better than nothing, but why can't the courts (that approve the settlement) have a web site that links to these? Or, as a condition of the settlement, require the company (Facebook in this case) to link to it?
I know lawyers are good at law, not IT security, and I realize this is how it's typically done, but it's still a very poor practice, and it needs to change.
(In this particular case, it's also ironic because the case is about poor practices regarding data security!)
---
[1] And this one has been, including very large news outlets, so I feel pretty confident it's legitimate.
- sigmar 4y agoI very much agree with this. Gmail seems to put every single class action suit email in my spam folder (probably because the domain that they come from are brand new, so understandable). Then the website always asks for a lot of personal information and sometimes bank routing numbers (!!). Maybe there could be subdomains on state gov't websites that are allocated for class action suits (tho that might still trigger spam detection)?
- JasserInicide 4y agoThis one at least has the option for a prepaid gift card
- the_only_law 4y agoSomething similar happened to me when I went to check the balance on a prepaid visa the other day. I got redirected to a bizzare URL and an ad riddled page. I had to do a couple of takes to make sure I was at the right place.
- chias 4y agoInterestingly, some time ago as part of my job I tested this out -- how effective is a fake breach settlement website / notification as a phishing vector? It turns out, to my surprise, not very. You can't harvest anything particularly juicy beyond basic PII without arousing a lot of suspicion, and as far as vectors for harvesting basic PII, more "normal" approaches are a lot more effective. Outside of very limited circumstances (e.g. when everyone is really angry, Hello Equifax!), the average person is remarkably uninterested in filling out data in return for an unknown amount of money, at some nebulously undefined future date, that is likely to be somewhere between $7 and $0.
- Eddy_Viscosity2 3y agoWhat kind of job was this exactly?