5 ms·

The biggest scare I've gotten is somehow ending up on "colnbase.com" (instead of "coinbase.com"). It's defunct now, but at the time it was a 1:1 replica of Coi

The biggest scare I've gotten is somehow ending up on "colnbase.com" (instead of "coinbase.com"). It's defunct now, but at the time it was a 1:1 replica of Coinbase. And the only reason I noticed was because 1Password didn't offer to fill in my credentials. While knowing someone's email/password combo might not be enough for an attacker to do anything malicious on Coinbase itself (due to email re-verification maybe), the point is that even the smartest of us Hacker News users can fall for it. And that should scare the rest of us.

gleenn 2y ago
So so true. 1Password refusing to auto fill a password has saved me multiple times in the past! Also, one of my friends has a PhD in literally rocket science (aeronautical engineering from MIT) and got scammed by someone who stole his brother's SIM card and did some shenanigans. No one is safe, no matter how smart or tech savvy you think you are! For the less tech savvy folks, I understand why they are scared, it's hard to give them even general tips to not lose the farm to fraudsters.
- paranoidrobot 2y ago
  The general advice I give is: Don't trust incoming calls, text messages or emails. Don't trust caller ID on your phone. If someone calls you asking for information or to do something, ask for a case id or reference number. Hang up, call back on a number you get from a previous bill, back of your credit card, or by googling the company. If anyone is pushing for something to be done urgently, stop. Hang up, don't take any action. Call a trusted other person and talk to them about it.
  - snypher 2y ago
    >by googling the company And remember it's going to be the 4th or 5th link down, not the first.
    - btown 2y ago
      This is one of many reasons why ad blocking isn't just cosmetic: it's a best practice for security too!
      - miki123211 2y ago
        So much this. I recently saved a friend from getting scammed when she wanted to buy an audiobook, we wanted to avoid Audible because of the DRM and limited device selection. The first few results she got were some shady services offering really good deals. I looked them up on trustpilot and they weren't outright scams, but they aggressively pushed you into getting an expensive monthly subscription that was basically impossible to cancel.
    - brookst 2y ago
      Yeah the first will be the scammers with a highly targeted ad buy, and who can even tell the difference between ads and search results these days?
      - jmb99 2y ago
        All of my search results are search results, because of ad blockers. Now, many of my search results suck due to SEO and whatnot, but that’s a different story.
  - jrib 2y ago
    I really wish phones would change the UI to make it more obvious that caller ID shouldn't be trusted.
  - bennettnate5 2y ago
    > Don't trust incoming calls, text messages or emails. > Don't trust caller ID on your phone. And if you're anyone of moderate fame, importance or cryptocurrency holdings, call back using a phone other than the one you received the call from. SS7 attacks remain relatively cheap , and redirecting an outgoing phone call placed to a phone number they know you're likely to call next is within the realm of feasible attacks.
  - ethbr1 2y ago
    > If anyone is pushing for something to be done urgently, stop. Hang up, don't take any action. Call a trusted other person and talk to them about it. This is honestly the #1 piece of advice to give friends and family. Almost every scam is predicated on urgency.
  - throwawaymobule 2y ago
    I have an entirely seperate phone and SIM for any service I think is important which demands a phone number. (prepay, I top it up by €5 every few months. Sadly I can't automate that) I generally refuse to give any number if I can help it. I can count on one hand the number of unsolicited calls/texts I've gotten.
- hn_acc1 2y ago
  I know that "rocket scientist" has been a standin for "smart person" or "genius", but in this case, I would be more surprised if a computer security expert (various job titles) had been scammed, because it's their job to be up on this stuff. How often does a rocket scientist deal with computer viruses, or phishing emails, etc compared to a security expert? Most of the time, their IT security expert (ideally) stops it before it gets to them..
  - gleenn 2y ago
    I may be more qualified then, I work in fraud. I accidentally called a fake airline number to get a refund for a Delta ticket and happily gave the guy my credit card for some such fee. If requiring a credit card fee to get a refund isn't a red flag, I don't know a better one. To be fair, my sister had found the number and three way joined me in because I was helping her buy the ticket. So an extra rule: don't even trust a phone number someone you know found because /they/ might have been the first victim and passing compromised information to you.
  - throwawaymobule 2y ago
    Rocket science is surprisingly straightforward, it's rocket engineering that's the tricky one.
    - patmorgan23 2y ago
      Yeah projectile motion is high school physics. Engineering the thing to not rip itself apart, melt, or explode is the hard part.
- noname120 2y ago
  Physical SIM cards should _always_ have a strong PIN set. It baffles me how many people either don't have a PIN or it's just set to 0000. You're basically handing over your whole digital life away to anyone who gets their hand on your SIM card.
  - e40 2y ago
    I didn’t even know that existed until now.
- tonyedgecombe 2y ago
  Smart people often have blind spots. The confidence you get from knowing one subject really well can leave you vulnerable in other areas. This is one of the reasons scammers like to target doctors.
- jorvi 2y ago
  > Also, one of my friends has a PhD in literally rocket science (aeronautical engineering from MIT) One of my friends is a nuclear physicist from TU Delft and they somehow managed to install a fake clone of Chrome haha. Somehow never got their accounts broken into or money stolen.
megablast 2y ago
> that even the smartest of us Hacker News users Well, ok then.
ziml77 2y ago
I nearly lost an account because I assumed that 1Password was just being dumb not offering to auto-fill credentials. Turns out I'm the dumb one for doubting it. Now if 1Password shows nothing to auto-fill I make damn sure I'm on the right site.
perryh2 2y ago
mvspace.com was a really good phishing site back in the day when MySpace was an actual thing.
Aachen 2y ago
> the only reason I noticed was because 1Password didn't offer to fill in my credentials. Nice, I always hope this will save me but I never landed on such a phishing site. How did it happen for you? About domain-based autofills, perhaps less so now than 5-10 years ago: it always seemed weird that the whole security industry seemed to say these plugins, or the browser's built-in password store, are dangerous because there were past vulnerabilities and any website you visit can exploit it. The way I see it: vulns get fixed, I just need to not be in the 1st wave of persons they target (risk type: plane crash, very small odds but sucks to be you); receiving phishing emails or messages happens constantly and apparently it works well enough to continue doing it and evading filters constantly (risk type: car crash, can happen and they get only the creds for the website being autofilled). Would recommend to anyone who then realises something is up when the autofill doesn't work, but ideally would have more evidence to back that up
- hombre_fatal 2y ago
  I don't remember how I ended up there but I'm sure it was a fake email. Just copy one of Coinbase's legit emails for something like "A withdrawal of $1,200 USD has been started" and you have the perfect bait.
inetknght 2y ago
> The biggest scare I've gotten is somehow ending up on "colnbase.com" (instead of "coinbase.com"). You might want to install some browser extensions to block content. Then block all content (set to whitelist) and selectively add the sites you know. If you end up on a new site with some amalgamation of letters that look familiar, the extension will rightfully block it and prompt you whether you want to whitelist or not. Big ole' red flag right there. Of course it's not foolproof. It is just another layer in the strategy of defense-in-depth.
- eviks 2y ago
  This is such a waste of time to do this for every single site! Especially when it's easier to rely on the password manager in cases like this
  - omoikane 2y ago
    What I do is a greater waste of time -- I have a separate browser profile for each individual site that I might log into, and javascript is only whitelisted for that one site in that profile. It's a real pain because whenever my browser adds a new config option, I have to update the settings in each of the ~20 profiles. It has saved me a few times where some rogue javascript tries to redirect me to some unexpected site, and the destination site simply doesn't load.
    - devsda 2y ago
      I think there's a Firefox extension for this usecase. Combining that with Multi-account container should make it easier to manage ?
    - LordGrignard 2y ago
      dude what how do you have so much free time my lazy ass just has ublock origin with some lists enabled that my even more techbro help me set up and it automatically stops me from visiting suspicious websites this feels like way too much work
Eikon 2y ago
https://www.merklemap.com/search?query=coinbase.com&page=0&type=distance https://www.merklemap.com/search?query=coinbase.com&page=0&t... There’s indeed a lot of them :)
eviks 2y ago
> 1Password didn't offer to fill in my credentials. > the point is that even the smartest of us Hacker News users can fall for it. But you didn't fall for it, a simple password manager technique worked as advertised?
davchana 2y ago
My friend was not smart as you, and religiously typed password on a fake Amazon website link clicked from an SMS promising a refund on recent purchase. Stopped only when it asked for 2FA code because there was no 2FA setup.
maccard 2y ago
One of the worst parts of using a oassword manager is that apps and websites don’t by default share their credentials. I could totally see me getting caught by a shady link to a website of an app that I use but because I’ve never logged into the website, 1Password makes me search for it.

gleenn 2y ago

So so true. 1Password refusing to auto fill a password has saved me multiple times in the past! Also, one of my friends has a PhD in literally rocket science (aeronautical engineering from MIT) and got scammed by someone who stole his brother's SIM card and did some shenanigans. No one is safe, no matter how smart or tech savvy you think you are! For the less tech savvy folks, I understand why they are scared, it's hard to give them even general tips to not lose the farm to fraudsters.

paranoidrobot 2y ago
The general advice I give is: Don't trust incoming calls, text messages or emails. Don't trust caller ID on your phone. If someone calls you asking for information or to do something, ask for a case id or reference number. Hang up, call back on a number you get from a previous bill, back of your credit card, or by googling the company. If anyone is pushing for something to be done urgently, stop. Hang up, don't take any action. Call a trusted other person and talk to them about it.
- snypher 2y ago
  >by googling the company And remember it's going to be the 4th or 5th link down, not the first.
  - btown 2y ago
    This is one of many reasons why ad blocking isn't just cosmetic: it's a best practice for security too!
    - miki123211 2y ago
      So much this. I recently saved a friend from getting scammed when she wanted to buy an audiobook, we wanted to avoid Audible because of the DRM and limited device selection. The first few results she got were some shady services offering really good deals. I looked them up on trustpilot and they weren't outright scams, but they aggressively pushed you into getting an expensive monthly subscription that was basically impossible to cancel.
  - brookst 2y ago
    Yeah the first will be the scammers with a highly targeted ad buy, and who can even tell the difference between ads and search results these days?
    - jmb99 2y ago
      All of my search results are search results, because of ad blockers. Now, many of my search results suck due to SEO and whatnot, but that’s a different story.
- jrib 2y ago
  I really wish phones would change the UI to make it more obvious that caller ID shouldn't be trusted.
- bennettnate5 2y ago
  > Don't trust incoming calls, text messages or emails. > Don't trust caller ID on your phone. And if you're anyone of moderate fame, importance or cryptocurrency holdings, call back using a phone other than the one you received the call from. SS7 attacks remain relatively cheap , and redirecting an outgoing phone call placed to a phone number they know you're likely to call next is within the realm of feasible attacks.
- ethbr1 2y ago
  > If anyone is pushing for something to be done urgently, stop. Hang up, don't take any action. Call a trusted other person and talk to them about it. This is honestly the #1 piece of advice to give friends and family. Almost every scam is predicated on urgency.
- throwawaymobule 2y ago
  I have an entirely seperate phone and SIM for any service I think is important which demands a phone number. (prepay, I top it up by €5 every few months. Sadly I can't automate that) I generally refuse to give any number if I can help it. I can count on one hand the number of unsolicited calls/texts I've gotten.
hn_acc1 2y ago
I know that "rocket scientist" has been a standin for "smart person" or "genius", but in this case, I would be more surprised if a computer security expert (various job titles) had been scammed, because it's their job to be up on this stuff. How often does a rocket scientist deal with computer viruses, or phishing emails, etc compared to a security expert? Most of the time, their IT security expert (ideally) stops it before it gets to them..
- gleenn 2y ago
  I may be more qualified then, I work in fraud. I accidentally called a fake airline number to get a refund for a Delta ticket and happily gave the guy my credit card for some such fee. If requiring a credit card fee to get a refund isn't a red flag, I don't know a better one. To be fair, my sister had found the number and three way joined me in because I was helping her buy the ticket. So an extra rule: don't even trust a phone number someone you know found because /they/ might have been the first victim and passing compromised information to you.
- throwawaymobule 2y ago
  Rocket science is surprisingly straightforward, it's rocket engineering that's the tricky one.
  - patmorgan23 2y ago
    Yeah projectile motion is high school physics. Engineering the thing to not rip itself apart, melt, or explode is the hard part.
noname120 2y ago
Physical SIM cards should _always_ have a strong PIN set. It baffles me how many people either don't have a PIN or it's just set to 0000. You're basically handing over your whole digital life away to anyone who gets their hand on your SIM card.
- e40 2y ago
  I didn’t even know that existed until now.
tonyedgecombe 2y ago
Smart people often have blind spots. The confidence you get from knowing one subject really well can leave you vulnerable in other areas. This is one of the reasons scammers like to target doctors.
jorvi 2y ago
> Also, one of my friends has a PhD in literally rocket science (aeronautical engineering from MIT) One of my friends is a nuclear physicist from TU Delft and they somehow managed to install a fake clone of Chrome haha. Somehow never got their accounts broken into or money stolen.

megablast 2y ago

> that even the smartest of us Hacker News users Well, ok then.

ziml77 2y ago

I nearly lost an account because I assumed that 1Password was just being dumb not offering to auto-fill credentials. Turns out I'm the dumb one for doubting it. Now if 1Password shows nothing to auto-fill I make damn sure I'm on the right site.

perryh2 2y ago

mvspace.com was a really good phishing site back in the day when MySpace was an actual thing.

Aachen 2y ago

> the only reason I noticed was because 1Password didn't offer to fill in my credentials. Nice, I always hope this will save me but I never landed on such a phishing site. How did it happen for you? About domain-based autofills, perhaps less so now than 5-10 years ago: it always seemed weird that the whole security industry seemed to say these plugins, or the browser's built-in password store, are dangerous because there were past vulnerabilities and any website you visit can exploit it. The way I see it: vulns get fixed, I just need to not be in the 1st wave of persons they target (risk type: plane crash, very small odds but sucks to be you); receiving phishing emails or messages happens constantly and apparently it works well enough to continue doing it and evading filters constantly (risk type: car crash, can happen and they get only the creds for the website being autofilled). Would recommend to anyone who then realises something is up when the autofill doesn't work, but ideally would have more evidence to back that up

hombre_fatal 2y ago
I don't remember how I ended up there but I'm sure it was a fake email. Just copy one of Coinbase's legit emails for something like "A withdrawal of $1,200 USD has been started" and you have the perfect bait.

inetknght 2y ago

> The biggest scare I've gotten is somehow ending up on "colnbase.com" (instead of "coinbase.com"). You might want to install some browser extensions to block content. Then block all content (set to whitelist) and selectively add the sites you know. If you end up on a new site with some amalgamation of letters that look familiar, the extension will rightfully block it and prompt you whether you want to whitelist or not. Big ole' red flag right there. Of course it's not foolproof. It is just another layer in the strategy of defense-in-depth.

eviks 2y ago
This is such a waste of time to do this for every single site! Especially when it's easier to rely on the password manager in cases like this
- omoikane 2y ago
  What I do is a greater waste of time -- I have a separate browser profile for each individual site that I might log into, and javascript is only whitelisted for that one site in that profile. It's a real pain because whenever my browser adds a new config option, I have to update the settings in each of the ~20 profiles. It has saved me a few times where some rogue javascript tries to redirect me to some unexpected site, and the destination site simply doesn't load.
  - devsda 2y ago
    I think there's a Firefox extension for this usecase. Combining that with Multi-account container should make it easier to manage ?
  - LordGrignard 2y ago
    dude what how do you have so much free time my lazy ass just has ublock origin with some lists enabled that my even more techbro help me set up and it automatically stops me from visiting suspicious websites this feels like way too much work

Eikon 2y ago

https://www.merklemap.com/search?query=coinbase.com&page=0&type=distance https://www.merklemap.com/search?query=coinbase.com&page=0&t... There’s indeed a lot of them :)

eviks 2y ago

> 1Password didn't offer to fill in my credentials. > the point is that even the smartest of us Hacker News users can fall for it. But you didn't fall for it, a simple password manager technique worked as advertised?

davchana 2y ago

My friend was not smart as you, and religiously typed password on a fake Amazon website link clicked from an SMS promising a refund on recent purchase. Stopped only when it asked for 2FA code because there was no 2FA setup.

maccard 2y ago

One of the worst parts of using a oassword manager is that apps and websites don’t by default share their credentials. I could totally see me getting caught by a shady link to a website of an app that I use but because I’ve never logged into the website, 1Password makes me search for it.