4 ms·

The company we use for our yearly mandated training has a cybersecurity "class" which tells you not to click links in emails (which is good advice!). Three gue

The company we use for our yearly mandated training has a cybersecurity "class" which tells you not to click links in emails (which is good advice!). Three guesses on how you log in to the service.

the8472 1y ago
> which tells you not to click links in emails (which is good advice!). Hardly. The company shouldn't have XSRF-vulnerable software, if your browser is vulnerable you have bigger problems and what you actually shouldn't do is enter your credentials or download stuff after clicking on that link. But of course there's an internal "phising test" that penalizes you for clicking on links... links that have been obfuscated by some email-modifying link-tracking security software that makes it nearly impossible to figure out to which domain the link even goes.
- Hackbraten 1y ago
  > what you actually shouldn't do is enter your credentials or download stuff after clicking on that link. Then why even click on it in the first place (and risk your email address getting flagged as active in some illicit database?)
  - the8472 1y ago
    Because the aforementioned built-in link obfuscation makes it hard to even tell if the link goes to one of our work domains. And pretty much all our stuff is behind SSO, so if something asks for creds that's an easier tell than hovering over the link and trying to figure out where it goes. And sometimes they introduce new tools on new domains that may be legit. Generally clicking on the link is not what gets you compromised (except for some spearphishing involving zero-days...). It's actions following that which might. So they're barking up the wrong tree and penalize people for that. That's just chicanery.
mysteria 1y ago
My bank tells me via email to not click on links in emails and to directly visit their homepage instead. That's fine, but that email itself contains a link to their fraud prevention page (to learn more) and another link to log into their online banking service. Do as I say, not as I do.
olyjohn 1y ago
Holy fuck this drives me insane. My company makes us do the idiotic trainings, which tell you all the "red flags" to look for. Then the goddamn CEO sends out an empty email, with a .docx attachment, and the subject saying "urgent, open immediately" The HR sends out suspicious looking shit all the time. The. You have Microsoft spamming you with fucking QR codes!!! You know what needs to happen? Disable all hyperlinks in email. Make everybody copy and paste the goddamn thing. Then they have to look at the link and they have to manually paste it into the browser. Then there are no obfuscated links. Also disable HTML email, images, and most file attachments. Then there is no pixel tracking, no possibility for malicious images to be auto-loaded, and no excuse for clicking a bad link.

The company we use for our yearly mandated training has a cybersecurity "class" which tells you not to click links in emails (which is good advice!). Three guesses on how you log in to the service.

the8472 1y ago

> which tells you not to click links in emails (which is good advice!). Hardly. The company shouldn't have XSRF-vulnerable software, if your browser is vulnerable you have bigger problems and what you actually shouldn't do is enter your credentials or download stuff after clicking on that link. But of course there's an internal "phising test" that penalizes you for clicking on links... links that have been obfuscated by some email-modifying link-tracking security software that makes it nearly impossible to figure out to which domain the link even goes.

Hackbraten 1y ago
> what you actually shouldn't do is enter your credentials or download stuff after clicking on that link. Then why even click on it in the first place (and risk your email address getting flagged as active in some illicit database?)
- the8472 1y ago
  Because the aforementioned built-in link obfuscation makes it hard to even tell if the link goes to one of our work domains. And pretty much all our stuff is behind SSO, so if something asks for creds that's an easier tell than hovering over the link and trying to figure out where it goes. And sometimes they introduce new tools on new domains that may be legit. Generally clicking on the link is not what gets you compromised (except for some spearphishing involving zero-days...). It's actions following that which might. So they're barking up the wrong tree and penalize people for that. That's just chicanery.

mysteria 1y ago

My bank tells me via email to not click on links in emails and to directly visit their homepage instead. That's fine, but that email itself contains a link to their fraud prevention page (to learn more) and another link to log into their online banking service. Do as I say, not as I do.

olyjohn 1y ago

Holy fuck this drives me insane. My company makes us do the idiotic trainings, which tell you all the "red flags" to look for. Then the goddamn CEO sends out an empty email, with a .docx attachment, and the subject saying "urgent, open immediately" The HR sends out suspicious looking shit all the time. The. You have Microsoft spamming you with fucking QR codes!!! You know what needs to happen? Disable all hyperlinks in email. Make everybody copy and paste the goddamn thing. Then they have to look at the link and they have to manually paste it into the browser. Then there are no obfuscated links. Also disable HTML email, images, and most file attachments. Then there is no pixel tracking, no possibility for malicious images to be auto-loaded, and no excuse for clicking a bad link.