5 ms·

I'm seeing a lot more of these phishing links relying on sites.google.com . Users are becoming trained to look at the domain, which appears correct to them. Is

I'm seeing a lot more of these phishing links relying on sites.google.com . Users are becoming trained to look at the domain, which appears correct to them. Is it a mistake of Google to continue to let people post user content on a subdomain of their main domain?

Apocryphon 1y ago
RIP the once-common practice of having a personal website (that would have a free host)
- foxrider 1y ago
  The "free" hosts were already harbingers of the end times. Once, having a dedicated IP address per machine stopped being a requirement, the personal website that would be casually hosted whenever your PC is on was done.
  - duskwuff 1y ago
    > the personal website that would be casually hosted whenever your PC is on I don't think that was ever really a thing. Which isn't to say that no one did it, but it was never a common practice. And free web site hosting came earlier than you're implying - sites like Tripod and Angelfire launched in the mid-1990s, at a time when most users were still on dialup.
    - Apocryphon 1y ago
      earliest of the three, GeoCities launched in 1994
      - eterm 1y ago
        For added context, geocities was started before Netscape Navigator was launched, and geocities was actually launched before Internet Explorer 1.0.
      - p3rls 1y ago
        [dead]
    - foxrider 1y ago
      Must be a regional thing, because where I live, mass internet adoption pretty much started in the 90s with the dedicated Ethernet connections. As such, every PC had its own IP address, it was a time before home routers. Later, the dreaded NAT was introduced, but the ISPs kept their "LAN" networks free. People hosted all sorts of things. It was a common practice for people to host an FTP server, a game server, an IRC and such on their home computers, and that "LAN" was not subject to the internet speed limit that was capped at around 600kb/s while the LAN would go as fast as the hardware allowed.
      - account42 1y ago
        That sounds like a very specific setup like a university dorm or perhaps managed apartment complex. But I doubt that was the norm for home internet connectivity anywhere, ever.
      - Apocryphon 1y ago
        Do you live in DARPA
    - robinsonb5 1y ago
      People did indeed do that - and dynamic DNS didn't kill it, thanks to services like dyndns back when it was free.
      - 1718627440 1y ago
        There are gratis DynDNS services?
        duskwuff 1y ago
        There were in the early 2000s. They certainly didn't emerge as early as free web hosting, though.
        1718627440 1y ago
        I meant that as a statement, that they are gratis today, paired with confusion, what they are talking about.
spogbiper 1y ago
the phishers use any of the free file sharing sites. I've seen dropbox, sharefile , even docusign URLs used as well. i don't think you want users considering the domain as a sign of validity, only that odd domains are definitely a sign of invalidity.
- newZWhoDis 1y ago
  I get 3-4 fake Docusign emails a week.
jkingsman 1y ago
Correlated data: sites.google.com has been blocked via machine policy at multiple workplaces I've come into contact with.
VladVladikoff 1y ago
It’s interesting how these big tech companies are playing a role in all these scams. I do a fair amount of paid ads on Facebook, and I get probably about 20 phishing messages a day via Facebook channels; trying to get me to install fake Facebook ads management apps (iOS TestFlight), or leading me to Facebook.com urls that are phishing pages via facebooks custom page designer. These messages come through Facebook, use facebooks own infrastructure to host their payloads, and use language which Facebook would know should only come from their own official channels. How is this not super easy for Facebook to block?? I can only explain it as sheer laziness/lack of care.
userbinator 1y ago
It's a mistake of Google to obfuscate URLs in their browser so much that it's hard to tell what the actual site is. I find this 7-year-old comment particularly ironic: https://news.ycombinator.com/item?id=17931747 https://news.ycombinator.com/item?id=17931747
rs186 1y ago
As long as sites.google.com is not blocked by Chrome (which will never happen) or until Google stops making money on them (which won't happen either because spammers are paying for it), Google will continue to run the service.
sunaookami 1y ago
When you share a link through the Google app it now gets "helpfully" shortened to a "share.google" domain. This is even worse.

Apocryphon 1y ago

RIP the once-common practice of having a personal website (that would have a free host)

foxrider 1y ago
The "free" hosts were already harbingers of the end times. Once, having a dedicated IP address per machine stopped being a requirement, the personal website that would be casually hosted whenever your PC is on was done.
- duskwuff 1y ago
  > the personal website that would be casually hosted whenever your PC is on I don't think that was ever really a thing. Which isn't to say that no one did it, but it was never a common practice. And free web site hosting came earlier than you're implying - sites like Tripod and Angelfire launched in the mid-1990s, at a time when most users were still on dialup.
  - Apocryphon 1y ago
    earliest of the three, GeoCities launched in 1994
    - eterm 1y ago
      For added context, geocities was started before Netscape Navigator was launched, and geocities was actually launched before Internet Explorer 1.0.
    - p3rls 1y ago
      [dead]
  - foxrider 1y ago
    Must be a regional thing, because where I live, mass internet adoption pretty much started in the 90s with the dedicated Ethernet connections. As such, every PC had its own IP address, it was a time before home routers. Later, the dreaded NAT was introduced, but the ISPs kept their "LAN" networks free. People hosted all sorts of things. It was a common practice for people to host an FTP server, a game server, an IRC and such on their home computers, and that "LAN" was not subject to the internet speed limit that was capped at around 600kb/s while the LAN would go as fast as the hardware allowed.
    - account42 1y ago
      That sounds like a very specific setup like a university dorm or perhaps managed apartment complex. But I doubt that was the norm for home internet connectivity anywhere, ever.
    - Apocryphon 1y ago
      Do you live in DARPA
  - robinsonb5 1y ago
    People did indeed do that - and dynamic DNS didn't kill it, thanks to services like dyndns back when it was free.
    - 1718627440 1y ago
      There are gratis DynDNS services?
      - duskwuff 1y ago
        There were in the early 2000s. They certainly didn't emerge as early as free web hosting, though.
        1718627440 1y ago
        I meant that as a statement, that they are gratis today, paired with confusion, what they are talking about.

spogbiper 1y ago

the phishers use any of the free file sharing sites. I've seen dropbox, sharefile , even docusign URLs used as well. i don't think you want users considering the domain as a sign of validity, only that odd domains are definitely a sign of invalidity.

newZWhoDis 1y ago
I get 3-4 fake Docusign emails a week.

jkingsman 1y ago

Correlated data: sites.google.com has been blocked via machine policy at multiple workplaces I've come into contact with.

VladVladikoff 1y ago

It’s interesting how these big tech companies are playing a role in all these scams. I do a fair amount of paid ads on Facebook, and I get probably about 20 phishing messages a day via Facebook channels; trying to get me to install fake Facebook ads management apps (iOS TestFlight), or leading me to Facebook.com urls that are phishing pages via facebooks custom page designer. These messages come through Facebook, use facebooks own infrastructure to host their payloads, and use language which Facebook would know should only come from their own official channels. How is this not super easy for Facebook to block?? I can only explain it as sheer laziness/lack of care.

userbinator 1y ago

It's a mistake of Google to obfuscate URLs in their browser so much that it's hard to tell what the actual site is. I find this 7-year-old comment particularly ironic: https://news.ycombinator.com/item?id=17931747 https://news.ycombinator.com/item?id=17931747

rs186 1y ago

As long as sites.google.com is not blocked by Chrome (which will never happen) or until Google stops making money on them (which won't happen either because spammers are paying for it), Google will continue to run the service.

sunaookami 1y ago

When you share a link through the Google app it now gets "helpfully" shortened to a "share.google" domain. This is even worse.