3 ms·

> - Part of the problem is just that a normal workflow is: receive email --> click on URL --> enter credentials into 3rd party website. ie, this is intentional

by jasode 1y ago

> - Part of the problem is just that a normal workflow is: receive email --> click on URL --> enter credentials into 3rd party website. ie, this is intentional and valid behavior for most white collar workers on a daily basis. Here's a crazy history of that happening... I had a friend who was an employee of a Fortune 100 corporation. Part of employee training was not to click on links in emails. In the 1990s and the rise of the internet, they had an internal security "red team" periodically send a fake phishing emails to employees. If the employee mistakenly clicked on a link in that email, the red team would send a notice to the employee's manager. It worked well because employees would not want to be embarrassed by a manager having to review the security policy with them to get their access back. When she retired, all that training became useless and she was phished by a fake AT&T email. Why? Because with the rise of smartphones, every _legitimate_ company started sending emails that had useful tappable links. With the touchscreen, you can't hover your finger over the link to see what the underlying url is. People just normalize pressing on links in transactional emails as a convenient thing to do. E.g. Amazon sends an email with a link to the order status. A legit bank will send an email with a link for "Please review your security setting." Smartphones reversed 15 years of not clicking on email links.

at-fates-hands 1y ago
The first company I worked for as a developer was like this, except worse. We got hit with some Christmas virus. One of the devs was talking about how he had mistakenly clicked on the link, but nothing happened. We were at lunch and suddenly were all looking at each other like, "Dave, this isn't good!" told him to call support because we had all seen the emails from security to not click on any links in emails because so many of these were making the rounds. They took his laptop, reimaged it and gave back to him. The funny part was the Outlook team disabled any links in any emails he got from then on. Not sure how they did it, but if you wanted to send him a link, you had to send it to his personal email or over one of his social media accounts. Any time he got a link, if it was for business, he would have to call support, open a ticket and then an hour later, they would send him the link to open. It drove the guys nuts. He asked repeatedly to have them enable the links, but they basically told him once you were on the list, it was for good. He quit after four months and said one of the most infuriating things was security never allowing him to get off of the "naughty" list.
- Etheryte 1y ago
  That is both diabolical and hilarious, it must be absolutely maddening. No wonder he quit.
- godelski 1y ago
  > if you wanted to send him a link Wait... why was no one just sending the link as plain text? So he could just copy paste? Or like news[dot]ycombinator[dot]com/item?id=45532515 I guess this also begs the question why email clients don't have an option to dereference links or convert them to plain text? Like Click here for your HN comment | v [Click here for your HN comment](https://news.ycombinator.com/item?id=45532515) I mean at the end of the day links are a formatting thing, right? I know it doesn't solve url shorteners, but then url shorteners become suspect, at least until some internal person starts being dumb and suggesting them because urls are way too long[0]. [0] but this also mostly seems solvable if we are okay with redirects and temporary info being passed in the link. Redirects might be an issue, but at least getting redirected from an official site is better than getting redirected from some shortening service. Maybe a big part of the problem is how we've bundled in so much tracking info...[1] [1] Which it's not like we haven't seen phishing links like https://ImALegitsite.conn.ImAnEvilSite.com https://ImALegitsite.conn.ImAnEvilSite.com https://ImALegitsite.conn.ImAnEvilSite.com

by jasode 1y ago

at-fates-hands 1y ago

The first company I worked for as a developer was like this, except worse. We got hit with some Christmas virus. One of the devs was talking about how he had mistakenly clicked on the link, but nothing happened. We were at lunch and suddenly were all looking at each other like, "Dave, this isn't good!" told him to call support because we had all seen the emails from security to not click on any links in emails because so many of these were making the rounds. They took his laptop, reimaged it and gave back to him. The funny part was the Outlook team disabled any links in any emails he got from then on. Not sure how they did it, but if you wanted to send him a link, you had to send it to his personal email or over one of his social media accounts. Any time he got a link, if it was for business, he would have to call support, open a ticket and then an hour later, they would send him the link to open. It drove the guys nuts. He asked repeatedly to have them enable the links, but they basically told him once you were on the list, it was for good. He quit after four months and said one of the most infuriating things was security never allowing him to get off of the "naughty" list.

Etheryte 1y ago
That is both diabolical and hilarious, it must be absolutely maddening. No wonder he quit.
godelski 1y ago
> if you wanted to send him a link Wait... why was no one just sending the link as plain text? So he could just copy paste? Or like news[dot]ycombinator[dot]com/item?id=45532515 I guess this also begs the question why email clients don't have an option to dereference links or convert them to plain text? Like Click here for your HN comment | v [Click here for your HN comment](https://news.ycombinator.com/item?id=45532515) I mean at the end of the day links are a formatting thing, right? I know it doesn't solve url shorteners, but then url shorteners become suspect, at least until some internal person starts being dumb and suggesting them because urls are way too long[0]. [0] but this also mostly seems solvable if we are okay with redirects and temporary info being passed in the link. Redirects might be an issue, but at least getting redirected from an official site is better than getting redirected from some shortening service. Maybe a big part of the problem is how we've bundled in so much tracking info...[1] [1] Which it's not like we haven't seen phishing links like https://ImALegitsite.conn.ImAnEvilSite.com https://ImALegitsite.conn.ImAnEvilSite.com https://ImALegitsite.conn.ImAnEvilSite.com