4 ms·

> I’m no security person, so the reasoning felt a bit weird to me, as I guess the .zip TLD can’t hurt anybody; downloading a .zip might, which you can attach to

by tetha 2y ago

> I’m no security person, so the reasoning felt a bit weird to me, as I guess the .zip TLD can’t hurt anybody; downloading a .zip might, which you can attach to any link name? Turn of all of your developer knowledge for a minute. You click on a link "very-trustworthy-ceo-information.zip" in a mail, since you want to download this very important information from your CEO. Sure, your browser pops up, but it does that all the time so who cares, and then there is a file "very-trustworthy-ceo-information.zip" in your downloads folder. Native Outlook might usually open it in a different way usually, but who cares? OWA - you won't notice a difference in the UI at all. But anyway, important CEO information. Open the zip, open the PDF, oops your workstation is compromised. If we turn our technical knowledge back on, it's rather simple. A user was phished to open a link to "https://very-trustworthy-ceo-information.zip https://very-trustworthy-ceo-information.zip". This returned with a file download, obviously called "very-trustworthy-ceo-information.zip", containing whatever I want to contain based off of IPs and whatever I can stuff into the link in a hidden fashion the average user won't note. A lot of people would not be able to distinguish between https://foo.zip https://foo.zip answering with a binary content type and naming the file foo.zip through content disposition headers and foo.zip coming from a trusted source. And honestly, I would personally have to double-check what's going on there if it happened to me.

w-m 2y ago
My point was that the person fooled by https://foo.zip/ https://foo.zip/ would have been also fooled by https://foo.com/bar.zip https://foo.com/bar.zip, so the existence .zip wouldn’t change much. But now I’ve understood that the auto-linkification of a simple non-link mention like update.zip can be indeed dangerous.
godzillabrennus 2y ago
Imagine a URL like http://www.chase.com.auth.statement.zip http://www.chase.com.auth.statement.zip Average users would never suspect a thing.
- eli 2y ago
  I genuinely do not see how that is different than http://www.chase.com.auth.statement.com http://www.chase.com.auth.statement.com
  - diggan 2y ago
    As a developer, the difference might be minimal, you see the http:// http:// part. For the average computer user, I'm guessing they don't "see" the http:// http:// part. It looks like a link to an attachment in the email, so safer than a random URL.
    - eli 2y ago
      But a random attachment would be much less safe than a random url!
  - Fatnino 2y ago
    I'm here with mobile Firefox and HN is abreviating the display of those links so they are ACTUALLY identical on my screen.

by tetha 2y ago

w-m 2y ago

My point was that the person fooled by https://foo.zip/ https://foo.zip/ would have been also fooled by https://foo.com/bar.zip https://foo.com/bar.zip, so the existence .zip wouldn’t change much. But now I’ve understood that the auto-linkification of a simple non-link mention like update.zip can be indeed dangerous.

godzillabrennus 2y ago

Imagine a URL like http://www.chase.com.auth.statement.zip http://www.chase.com.auth.statement.zip Average users would never suspect a thing.

eli 2y ago
I genuinely do not see how that is different than http://www.chase.com.auth.statement.com http://www.chase.com.auth.statement.com
- diggan 2y ago
  As a developer, the difference might be minimal, you see the http:// http:// part. For the average computer user, I'm guessing they don't "see" the http:// http:// part. It looks like a link to an attachment in the email, so safer than a random URL.
  - eli 2y ago
    But a random attachment would be much less safe than a random url!
- Fatnino 2y ago
  I'm here with mobile Firefox and HN is abreviating the display of those links so they are ACTUALLY identical on my screen.