3 ms·

If I hover over the link like my phishing training says to do, Chrome correctly shows it as "https://v1271.zip https://v1271.zip" If I don't bother hovering ov

by eli 3y ago

If I hover over the link like my phishing training says to do, Chrome correctly shows it as "https://v1271.zip https://v1271.zip" If I don't bother hovering over the link then the domain never mattered at all. Could have hosted the file anywhere since the link text in HTML (including HTML email) need not have any relation to the destination. You can simply write a legitimate github.com link but the href goes somewhere else. Any situation where you're relying on users to visually inspect every link and decide if the domain looks plausible is already a security failure. If I'm downloading and executing files that are randomly in a Medium article or in my inbox from an untrusted source then we're in trouble whether they are hosted on github or not.

wnevets 3y ago
> If I hover over the link like my phishing training says to do How do you hover on mobile? Instead of training my family members to hover on their phone's I will continue to just block these TLDs.
- eli 3y ago
  I’m confused what you’re advocating. If your family isn’t checking the domain before downloading and executing files then the .zip tld doesn’t matter. They’re just as vulnerable to phishing without it.
  - wnevets 3y ago
    > I’m confused what you’re advocating. I'm advocating using a pi-hole to block problematic domains on your network using list like the one from StevenBlack and entire TLDs that could be confusing. If you don't think .zip & .mov could be confusing then feel free to not block them.