5 ms·

Phishing has a few basic conceptual problems which no one seems to want to address: - You don't need to really be "fooled" by phishing. Not in the real sense

Phishing has a few basic conceptual problems which no one seems to want to address: - You don't need to really be "fooled" by phishing. Not in the real sense. You just need to be tired one morning and click without looking. Even if you know how to check for phishing, you might need to click on content from 10s to 100s of emails per day. Scale this out to 1 year, and even the most educated among us can fail due to an honest mistake which we otherwise could have prevented. - Part of the problem is just that a normal workflow is: receive email --> click on URL --> enter credentials into 3rd party website. ie, this is intentional and valid behavior for most white collar workers on a daily basis. This behavioral pattern is why phishing works, and in reality, email should not be a vector for this path. Until companies and technologies stop assuming this makes sense, phishing will continue to be successful.

nemomarx 1y ago
The fact that your employer might direct you to a URL that doesn't look like their normal domain (or through some kinda link shortener so you can't see it without clicking) for legitimate reasons basically undoes all security yeah. Why can't security teams focus on correcting those parts?
- whydoyoucare 1y ago
  The normal workflow is so ingrained in our company culture, that I received an email from our IT team about not clicking on embedded links, and that email had a embedded link to "learn more". ;-)
  - bee_rider 1y ago
    Maybe that was a test.
    - whydoyoucare 1y ago
      I thought so too, but no, it wasn't.
simonw 1y ago
These both seem like arguments for phishing-resistant auth methods to me (like passkeys).
bee_rider 1y ago
I’m somewhat surprised that enterprise email solutions still allow links… like, at all, in general. The servers should scan emails for links and not allow them. If a link somehow slips through, the client should not render it as something you can click on and follow. On work machines where everything is managed by IT, there shouldn’t be any need to send links around anyway. If anyone thinks they need to send a link around as an ongoing process, then that’s the sign that the process still needs to be designed.
- everdrive 1y ago
  >I’m somewhat surprised that enterprise email solutions still allow links… like, at all, in general. Completely agreed, and I think it's telling that so few email clients or webmail services actually allow you to always render as plain text.
- misterprime 1y ago
  This sounds quite short sighted to me. You can’t imagine needing links being sent in everyday workflow at the office, yet I can’t imagine not using links in emails. How would people interact with vendors and salespeople that send links to product specs, troubleshooting articles, etc?
  - bee_rider 1y ago
    If it is a vendor you are buying hardware from, they could send a part number, for example. The workflow should be go to their site, and search it up. I don’t think it is short sited. Actually, I think if it has a flaw it is the opposite one. Workflows that involve mailing around links are convenient for quick little in-the-moment thrown together actions. It’s liberating. I’ve done it too, sure. But, in the long run everything should be integrated somehow or another and sending links should not be necessary. One might say it is ridiculous to expect every process to reach that end state. Possibly true, but it is a good goal…
  - rwallace 1y ago
    In general, if a program is not a Web browser, I do not want that program getting clever with displaying a URL as an active link. Just show it as the URL, https prefix and all, so I can see where it will be taking me if I copy it into the browser. (This is one of my very few gripes with Google docs.)
billy99k 1y ago
I don't click on any urls from email. This should be the standard.
jasode 1y ago
> - Part of the problem is just that a normal workflow is: receive email --> click on URL --> enter credentials into 3rd party website. ie, this is intentional and valid behavior for most white collar workers on a daily basis. Here's a crazy history of that happening... I had a friend who was an employee of a Fortune 100 corporation. Part of employee training was not to click on links in emails. In the 1990s and the rise of the internet, they had an internal security "red team" periodically send a fake phishing emails to employees. If the employee mistakenly clicked on a link in that email, the red team would send a notice to the employee's manager. It worked well because employees would not want to be embarrassed by a manager having to review the security policy with them to get their access back. When she retired, all that training became useless and she was phished by a fake AT&T email. Why? Because with the rise of smartphones, every _legitimate_ company started sending emails that had useful tappable links. With the touchscreen, you can't hover your finger over the link to see what the underlying url is. People just normalize pressing on links in transactional emails as a convenient thing to do. E.g. Amazon sends an email with a link to the order status. A legit bank will send an email with a link for "Please review your security setting." Smartphones reversed 15 years of not clicking on email links.
- at-fates-hands 1y ago
  The first company I worked for as a developer was like this, except worse. We got hit with some Christmas virus. One of the devs was talking about how he had mistakenly clicked on the link, but nothing happened. We were at lunch and suddenly were all looking at each other like, "Dave, this isn't good!" told him to call support because we had all seen the emails from security to not click on any links in emails because so many of these were making the rounds. They took his laptop, reimaged it and gave back to him. The funny part was the Outlook team disabled any links in any emails he got from then on. Not sure how they did it, but if you wanted to send him a link, you had to send it to his personal email or over one of his social media accounts. Any time he got a link, if it was for business, he would have to call support, open a ticket and then an hour later, they would send him the link to open. It drove the guys nuts. He asked repeatedly to have them enable the links, but they basically told him once you were on the list, it was for good. He quit after four months and said one of the most infuriating things was security never allowing him to get off of the "naughty" list.
chasil 1y ago
Exchange ought to have the capability of rewriting the links' hrefs to a "link gateway" where a sandboxed renderer presents the outside page, maybe running over rdp and purged after the end of every session. The local Blink (or WebKit) renderer should be for internal or white listed sites only.
- pixl97 1y ago
  There are vendor solutions that do just this, converting all links to some kind of proxy service.
- mr_mitm 1y ago
  And then what? The end goal of phishing is either that the victim enters credentials or downloads a malicious file. Neither of which would be prevented by your scheme (even anti virus products are imperfect). Phishing with the goal of exploiting a zero day in the browser are exceedingly rare.
thewebguyd 1y ago
Re: the receive email -> click URL -> enter credentials. We need SSO to stop being gated behind enterprise tiers. SSO tax is real, and can help solve this problem. I've moaned about this before as the leader of an IT team for a medium-sized company reliant on a lot of SaaS. Enterprise plans are too much (both in terms of cost and features) for us, but we are smart enough to have security requirements and one of those is SSO & SCIM. Very few SaaS offers that on anything but the most expensive "call for quote" tiers. That's a huge problem. That whole email invite->click link->enter credentials workflow is gone with proper SCIM provisioning and SSO. It's the bare minimum a SaaS product should offer and should be on the lowest available tier. The other problem are services like DocuSign, which offer free trials that are abused to send out fake documents. User gets a legitimate email from DocuSign's domain, clicks on it, opens up a real document in the real DocuSign site, but the doc has a link to the phishing site. All DocuSign needs to do is require a CC for the trial or contacting sales for a trial, problem solved. But they don't, so as far as I'm concerned they are complicit in enabling phishing.
- Marsymars 1y ago
  Unfortunately, SSO often gets half-assed as a compliance exercise, and now you have to enter your SSO username/password and your MFA token in random places a dozen times per day.
  - doubled112 1y ago
    We actually force reauthentication on some services tied to our SSO. Just authenticated to the main page? Screw you, enter your credentials some more. It’s more secure this way.

nemomarx 1y ago

The fact that your employer might direct you to a URL that doesn't look like their normal domain (or through some kinda link shortener so you can't see it without clicking) for legitimate reasons basically undoes all security yeah. Why can't security teams focus on correcting those parts?

whydoyoucare 1y ago
The normal workflow is so ingrained in our company culture, that I received an email from our IT team about not clicking on embedded links, and that email had a embedded link to "learn more". ;-)
- bee_rider 1y ago
  Maybe that was a test.
  - whydoyoucare 1y ago
    I thought so too, but no, it wasn't.

simonw 1y ago

These both seem like arguments for phishing-resistant auth methods to me (like passkeys).

bee_rider 1y ago

I’m somewhat surprised that enterprise email solutions still allow links… like, at all, in general. The servers should scan emails for links and not allow them. If a link somehow slips through, the client should not render it as something you can click on and follow. On work machines where everything is managed by IT, there shouldn’t be any need to send links around anyway. If anyone thinks they need to send a link around as an ongoing process, then that’s the sign that the process still needs to be designed.

everdrive 1y ago
>I’m somewhat surprised that enterprise email solutions still allow links… like, at all, in general. Completely agreed, and I think it's telling that so few email clients or webmail services actually allow you to always render as plain text.
misterprime 1y ago
This sounds quite short sighted to me. You can’t imagine needing links being sent in everyday workflow at the office, yet I can’t imagine not using links in emails. How would people interact with vendors and salespeople that send links to product specs, troubleshooting articles, etc?
- bee_rider 1y ago
  If it is a vendor you are buying hardware from, they could send a part number, for example. The workflow should be go to their site, and search it up. I don’t think it is short sited. Actually, I think if it has a flaw it is the opposite one. Workflows that involve mailing around links are convenient for quick little in-the-moment thrown together actions. It’s liberating. I’ve done it too, sure. But, in the long run everything should be integrated somehow or another and sending links should not be necessary. One might say it is ridiculous to expect every process to reach that end state. Possibly true, but it is a good goal…
- rwallace 1y ago
  In general, if a program is not a Web browser, I do not want that program getting clever with displaying a URL as an active link. Just show it as the URL, https prefix and all, so I can see where it will be taking me if I copy it into the browser. (This is one of my very few gripes with Google docs.)

billy99k 1y ago

I don't click on any urls from email. This should be the standard.

jasode 1y ago

> - Part of the problem is just that a normal workflow is: receive email --> click on URL --> enter credentials into 3rd party website. ie, this is intentional and valid behavior for most white collar workers on a daily basis. Here's a crazy history of that happening... I had a friend who was an employee of a Fortune 100 corporation. Part of employee training was not to click on links in emails. In the 1990s and the rise of the internet, they had an internal security "red team" periodically send a fake phishing emails to employees. If the employee mistakenly clicked on a link in that email, the red team would send a notice to the employee's manager. It worked well because employees would not want to be embarrassed by a manager having to review the security policy with them to get their access back. When she retired, all that training became useless and she was phished by a fake AT&T email. Why? Because with the rise of smartphones, every _legitimate_ company started sending emails that had useful tappable links. With the touchscreen, you can't hover your finger over the link to see what the underlying url is. People just normalize pressing on links in transactional emails as a convenient thing to do. E.g. Amazon sends an email with a link to the order status. A legit bank will send an email with a link for "Please review your security setting." Smartphones reversed 15 years of not clicking on email links.

at-fates-hands 1y ago
The first company I worked for as a developer was like this, except worse. We got hit with some Christmas virus. One of the devs was talking about how he had mistakenly clicked on the link, but nothing happened. We were at lunch and suddenly were all looking at each other like, "Dave, this isn't good!" told him to call support because we had all seen the emails from security to not click on any links in emails because so many of these were making the rounds. They took his laptop, reimaged it and gave back to him. The funny part was the Outlook team disabled any links in any emails he got from then on. Not sure how they did it, but if you wanted to send him a link, you had to send it to his personal email or over one of his social media accounts. Any time he got a link, if it was for business, he would have to call support, open a ticket and then an hour later, they would send him the link to open. It drove the guys nuts. He asked repeatedly to have them enable the links, but they basically told him once you were on the list, it was for good. He quit after four months and said one of the most infuriating things was security never allowing him to get off of the "naughty" list.

chasil 1y ago

Exchange ought to have the capability of rewriting the links' hrefs to a "link gateway" where a sandboxed renderer presents the outside page, maybe running over rdp and purged after the end of every session. The local Blink (or WebKit) renderer should be for internal or white listed sites only.

pixl97 1y ago
There are vendor solutions that do just this, converting all links to some kind of proxy service.
mr_mitm 1y ago
And then what? The end goal of phishing is either that the victim enters credentials or downloads a malicious file. Neither of which would be prevented by your scheme (even anti virus products are imperfect). Phishing with the goal of exploiting a zero day in the browser are exceedingly rare.

thewebguyd 1y ago

Re: the receive email -> click URL -> enter credentials. We need SSO to stop being gated behind enterprise tiers. SSO tax is real, and can help solve this problem. I've moaned about this before as the leader of an IT team for a medium-sized company reliant on a lot of SaaS. Enterprise plans are too much (both in terms of cost and features) for us, but we are smart enough to have security requirements and one of those is SSO & SCIM. Very few SaaS offers that on anything but the most expensive "call for quote" tiers. That's a huge problem. That whole email invite->click link->enter credentials workflow is gone with proper SCIM provisioning and SSO. It's the bare minimum a SaaS product should offer and should be on the lowest available tier. The other problem are services like DocuSign, which offer free trials that are abused to send out fake documents. User gets a legitimate email from DocuSign's domain, clicks on it, opens up a real document in the real DocuSign site, but the doc has a link to the phishing site. All DocuSign needs to do is require a CC for the trial or contacting sales for a trial, problem solved. But they don't, so as far as I'm concerned they are complicit in enabling phishing.

Marsymars 1y ago
Unfortunately, SSO often gets half-assed as a compliance exercise, and now you have to enter your SSO username/password and your MFA token in random places a dozen times per day.
- doubled112 1y ago
  We actually force reauthentication on some services tied to our SSO. Just authenticated to the main page? Screw you, enter your credentials some more. It’s more secure this way.