8 ms·
Ah no need, corporate IT already make all URLs malicious looking through some microsoft "secure link" service, and constantly shows everyone shady looking promp
by arghwhat 1y ago
Ah no need, corporate IT already make all URLs malicious looking through some microsoft "secure link" service, and constantly shows everyone shady looking prompts that constantly change and have cmd.exe windows flash in at random.
A phone call from Microsoft about my Norton anti-virus subscription putting me into debt that can only be settled with Nintendo gift cards bought in cash across 16 specific gas stations seem much more legitimate in comparison.
- beanjuiceII 1y agowe must work at the same enterprise
- cedilla 1y agoAll that anti-phishing training that taught us to look closely at the URL and now it's all just safelinks.protection.outlook.com
- fp64 1y agoI find it very difficult to inspect the email headers in Outlook, I think for the iOS app it's not even possible. It's almost like they want to make it less transparent and secure
- syllogism 1y agoIn Europe there are legitimate and extremely established services that require you to input your bank login details into something other than your bank's website. It's madness.
- bombcar 1y agoMultiple US hospitals and insurance companies use genuine links like doctor-services-for-u.biz - infuriating.
- dtech 1y agoThere's no legitimate case for that since PSD2 (mandatory since 2020). Are you not confused by that? PSD2 doesn't share your credentials. I'm an European and have never needed to use nor encountered those services.
- siva7 1y agoPSD2 is just MFA, it doesn't prevent shady companies still asking your login credentials, even if you must authorize that login from your official banking app. Klarna is one of many examples - they ask me for my bank credentials on their own website so they can crawl all my finance data .
- bradfa 1y agoPlaid and Finicity do this in the USA for some linking of banking to other financial products. Feels SO insecure. Connecting my credit union checking account through Plaid even ironically brought me to a login page which explicitly states I should never give my banking password to any other entity. If I need to link my accounts and these services are the only choice then I change my banking passwords immediately after.
- chrisweekly 1y agoI thought Plaid used OAuth2. Hmm.
- cpburns2009 1y agoPlaid asks for your raw bank credentials so that it can scrape up data. That's why I've always refused to use it.
- WOTERMEON 1y agoI really hope to never be in the position where I have to use it
- 1y ago
- fancyfredbot 1y agoCare to mention what these legitimate and established services are?
- deleted 1y ago[deleted]
- JLCarveth 1y agoPlaid is used by a lot of the major Canadian banks.
- raudette 1y agoFlinks is also an often-used aggregator in Canada. "Connecting" savings accounts from EQ Bank or Wealthsimple to an account at TD Bank requires providing TD credentials to Flinks.
- joshuaissac 1y agoSofort used to do this. I don't know if they still do.
- FinnKuhn 1y agoPaypal, Klarna
- BrandoElFollito 1y agoAre you talking about the possibility to pay via your bank account directly on a checkout page? If so this is the bank page you are using. Can you give some examples?
- BlindEyeHalo 1y agoI find this hard to believe and have never seen that ever.
- jeltz 1y agoIt used to be common 5 years ago before PSD2.
- brettermeier 1y agoDon't understand the downvotes, i never saw that too, and i am shopping online very often.
- consp 1y agoIf you used the first gen "pay later" services they'd scrape you for "compliance checking" or simply mask it as a transaction which is actually just personal information scraping. Most of the times you did not see it, as it's obfuscated as a part of the transaction. They are also the companies complaining a lot about the "failure" of the PSD standards since it limits how much and how obfuscated they can scrape everything (and there are records).
- PeterStuer 1y agoAre you sure? Never seen any such thing.
- didsomeonesay 1y agoName and shame: Klarna did this. Not sure if they still do because i stay well clear of them.
- devoutsalsa 1y agoI recently reported an email with “glint.email.microsoft” as a phishing attempt, but it turned out to be a corporate survey.
- Thorrez 1y agoWell it's probably hard for anyone except Microsoft to get a domain with the .microsoft TLD.
- milkshakes 1y agowhat percentage of the online population do you expect to understand this?
- r_lee 1y agolegit. I could imagine something like x-mucrosoft.email etc. being used and the users would just be like well there was email.microsoft so same thing!
- greengreengrass 1y agoI have often wondered why we don’t see more usage of the brand gTLDs, which many of these big firms own. I muse that this is (part of) the reason why – there simply isn’t the understanding or recognition outside tech circles (or even within tech circles) to comprehend that it is possible to use such a gTLD without a conventional .com or similar suffix tacked on the end. I tend to see it localised to use for marketing micro sites that do not ask for credentials so have no need to establish user trust, or occasionally internal technical uses that will never touch the typical customer’s eyeballs. The other reason I hypothesise is that corporate big brother snooping systems that have whitelists for their trusted services – with entries like mail.google.com or calendar.google.com – are simply too painful at this point for big tech to break for their customers by dropping the .com suffix, so big tech doesn’t bother. No hard data on any of that, though.
- Thorrez 1y ago
- jcims 1y agoOutlook has a rule filter for header content. Just saying I haven't failed a phishing test in ~10 years.
- sciencejerk 1y agoMind sharing your filter rules? KnowBe4 uses X-PHISHTEST header and I think I saw Proofpoint using something similiar a few years back
- jcims 1y agoStraight from the source: https://help.proofpoint.com/Proofpoint_Essentials/Security_Awareness/Educate/Searchable_Header_in_Mail_Server https://help.proofpoint.com/Proofpoint_Essentials/Security_A... xD The vast majority of security controls are designed for the careless and the clueless.
- jsmith99 1y agoMy IT department use the official Microsoft phishing test. The emails arrive in inbox with 0 headers. (There's also a helpful Microsoft page of all the dodgy sounding domains they've registered for this.)
- monocularvision 1y agoI did this and it worked for a few months before word got to security who then forced everyone to remove the rule.
- prmoustache 1y agoI just don't check my emails anymore. If it is important, people will complain on teams that nobody answer with some sort of urgency and then I'll look for it specifically.
- Workaccount2 1y agoMy It department does mandatory phishing training every year, and then for the "test" e-mails, they spoof a domain and whitelist the DMARC on their side so it goes through. So we get e-mails from @microsoft.com and it's only if you dig in the metadata that you see it failed authentication. The only tell in the e-mail is checking the URL, which doesn't tell you much because tons of regular e-mails use tracker redirects too. They even send emails from our own domain or the domain of our payroll company. I won't type out my rant, but our IT department is a few guys who couldn't figure out what to do when their competitive xbox FIFA 2006 dreams failed, heard IT pays a lot with not much work, and then sat through the certs.
- stronglikedan 1y ago> heard IT pays a lot with not much work I want to live in this fantasy world! (Our IT dept is so overworked that I go out of my way to work around them purely out of empathy.)
- throwawaylaptop 1y agoEvery industry has its bad employers and good. I know teachers that make $50k and no pension, with others making $93k, halfways to their pension at 35yrs old, get almost 12 weeks off total a year, and work from 8am to 3pm (1 hour lunch, 1 hour for 'prep' aka Netflix) and home by 335, and no, they basically never do any work at home. She technically has students (10 year olds she sends links to for their chrome books) about 5x53 minutes a day.
- fair_enough 1y agoThat sounds like a good semi-retirement gig just to get out of the house for a little while. If you're teaching the tech-related electives rather than mandatory core courses, the students are likely a lot more pleasant to deal with. I took German just to get away from the all the kids taking Spanish or French who were just there because they have to get their foreign language credit.
- omh 1y agoAnd Microsoft own the client, so they are the one company who don't need to do this! If you really want to check every time someone clicks on a link then you can do this in the client and keep the visible link the same for the end user. But instead there are different teams working on this in Outlook, Teams, Exchange, Defender and god knows where else. (I'm one of the people in corporate IT trying to turn this off and often struggling)
- fphilipe 1y agoIn addition to making the link look shady, it adds considerable lag to opening the link. I'm using Finicky[1] on Mac to rewrite the URL by extracting the original URL from the query params[2]. 1: https://github.com/johnste/finicky https://github.com/johnste/finicky 2: https://github.com/fphilipe/dotfiles/blob/31e3d18fe5f51b2fd86cb7f1762453c1c4779ef9/finicky.js#L4-L8 https://github.com/fphilipe/dotfiles/blob/31e3d18fe5f51b2fd8...
- touristtam 1y agoNice, I use finicky as well, but now and again I have to change a rule or even add a new one. pisses me right off. Anyway thank you for sharing your dotfiles.
- btbuildem 1y agoMy little hobby is reporting any and all emails about compliance, training, etc (basically anything with actions in them) as phishing and then escalating their responses as "social engineering". It's fun!
- dogleash 1y agoIm in the security alias and that happens unironically every time the company rolls out a new external service. Now sketchy emails are preceded by an equally sketchy “it’s ok” email from IT.
- cameronh90 1y agoIt’s a trade-off. Most people are never going to check the links no matter how much you ask them to, and even if they did they wouldn’t know what to check for. But the tool Microsoft give you to check a link before opening it is that awful URL rewriter, which prevents the small minority who would check from being able to. Similarly those flashing cmd windows are usually automatic update processes that Windows has no way to hide. Even some drivers that MS distribute through Windows Update do it. We could turn automatic updates off, but then nobody would update their software. IT is rough because you’re often stuck between a rock and a hard place. On the one side you have users who don’t want to change their behaviour, on the other side you have industry leading vendors, that the SLT insist on using, that make it impossible to do the right thing or put the right thing on an Enterprise plan that the budget won’t permit. Then to top it off, there are usually compliance and insurance breathing down your neck forcing you to implement questionable best practices from the 90s, so you just have to do your best to limit the damage.
- mobiuscog 1y agoThere is an easy answer. Give employees two computers. One is the 'business' one. Mostly locked down, with checks in place. The other is on a different network, isolated from all business functions, and they can do what they want but must never use it for work data, just like their phones (that everyone knows they use for social media etc. in the day). Sure, you still have to deal with copying from one to the other (but there are solutions for that if critical, and much easier to secure). It sounds crazy, but air-gaps are largely proven and it also means that employees feel less oppressed. Now I realise, even ignoring the cost, businesses won't want this, as perish the thought their employees may do anything other than work. But I suspect it would actually stop more attacks and issues than otherwise and maybe... just maybe.. employees feel as if they're actually human.
- sigwinch 1y agoJust call one business internal and the other one LLM inference. You don’t want AI crafting packets on business internal.
- 1y ago