2 ms·
About 12 years ago or something, I used to chat on a 'talker'. Telnet talker.thevillage.something:8833 or similar. You had a login etc, and it was good fun. So
by axod 18y ago
About 12 years ago or something, I used to chat on a 'talker'. Telnet talker.thevillage.something:8833 or similar. You had a login etc, and it was good fun.
So, I started learning about network programming etc, and built my own talker. Registration etc etc. I got quite a few people to register on it, and was surprised when I realized they were just using the same login details as they used on the 'main' talker we talked on.
So I logged in as one of them on the main talker and impersonated him... got banned for a bit. It really is surprising how easily this is done. (I was young, and foolish).
"Hey can you just try out this webapp for me? register here." <-- Always use a 'throwaway' login.
- derefr 18y agoI just had a brilliant idea (or, at least, I'd call it brilliant if it were foisted upon me): a demonstration of the true possibilities of phishing, in real-time AJAX in front of users' eyes. Have a one-page lure for an attractive webapp, with registration right there on the front page ("all you need is a username and password!") When you put in your details, however, instead of doing any "registration", it works for a few seconds in the background, and then pops up a box listing all the sites it just logged into successfully using that username/password combination. As long as it's done by someone reputable enough that users won't think they actually got their password recorded by the server (Microsoft? Bruce Schneier?) it could be a very successful educational technique.