2 ms·

> So the next idea is to register the domain as a subdomain I think the problem is, someone in the IT department understands the high risk associated with hand

> So the next idea is to register the domain as a subdomain I think the problem is, someone in the IT department understands the high risk associated with handing out subdomains, so they refuse to do it. So other parts of the company "work around" this by registering their own domain name. I wonder how companies like Google handle this. A subdomain of google.com is probably the most valuable hack target in the world, but google does use subdomains occasionally (...or maybe more than occasionally! https://gist.github.com/abuvanth/b9fcbaf7c77c2954f96c6e556138ffe8 https://gist.github.com/abuvanth/b9fcbaf7c77c2954f96c6e55613...)

mike_hearn 1y ago
Nearly. It almost certainly never even touched IT. The issue is that marketing is organizationally separate from IT and doesn't want to interact with them. IT is probably behind a slow, outsourced ticket based process and will take weeks to do a simple thing. They may also have random opinions about stuff marketing doesn't want them to have opinions about. So building out promos like this is delegated to SaaS services or contractors who also have no relationship with corporate IT. Then nobody in marketing really knows or cares what a subdomain is, because everything they do is just searching Google or clicking links. They never look at the address bar because it's always full of meaningless junk so why would they or anyone else care what's in it? Anti-phishing training doesn't make sense, when you look at how people really use the internet. Not many people look at the actual text of a URL. The best anti-phishing training is "go to google and type what you're looking for, only click links from there" and not "carefully examine the domain name to try and intuit if it's owned by the organization you think it is".
- cyberbanjo 1y ago
  Have you tried what you're recommending without an ad block extension recently?
  - mike_hearn 1y ago
    I never use adblockers, so yes.
- LorenPechtel 1y ago
  Doesn't need to be IT being slow. I've seen it happen--we warned the guy to talk to us before putting up the new website. Admittedly, I was on the other side of the world and only reachable by e-mail, but the other guy was there in his office. I don't know if he ever truly understood how he took out all company e-mail for nearly a week. And trust links from Google? Keep up with the times! Sometimes the first hit is the scammers.
valenterry 1y ago
Google handles it in the same shitty way. They send mails that could be phishing mails and use not only google.com but many other weird domains like goo.gl or foobar.google and so on. Terrible. The times were one could rely on them have long passed.

mike_hearn 1y ago

Nearly. It almost certainly never even touched IT. The issue is that marketing is organizationally separate from IT and doesn't want to interact with them. IT is probably behind a slow, outsourced ticket based process and will take weeks to do a simple thing. They may also have random opinions about stuff marketing doesn't want them to have opinions about. So building out promos like this is delegated to SaaS services or contractors who also have no relationship with corporate IT. Then nobody in marketing really knows or cares what a subdomain is, because everything they do is just searching Google or clicking links. They never look at the address bar because it's always full of meaningless junk so why would they or anyone else care what's in it? Anti-phishing training doesn't make sense, when you look at how people really use the internet. Not many people look at the actual text of a URL. The best anti-phishing training is "go to google and type what you're looking for, only click links from there" and not "carefully examine the domain name to try and intuit if it's owned by the organization you think it is".

cyberbanjo 1y ago
Have you tried what you're recommending without an ad block extension recently?
- mike_hearn 1y ago
  I never use adblockers, so yes.
LorenPechtel 1y ago
Doesn't need to be IT being slow. I've seen it happen--we warned the guy to talk to us before putting up the new website. Admittedly, I was on the other side of the world and only reachable by e-mail, but the other guy was there in his office. I don't know if he ever truly understood how he took out all company e-mail for nearly a week. And trust links from Google? Keep up with the times! Sometimes the first hit is the scammers.

valenterry 1y ago

Google handles it in the same shitty way. They send mails that could be phishing mails and use not only google.com but many other weird domains like goo.gl or foobar.google and so on. Terrible. The times were one could rely on them have long passed.