Hacker News Reader

Comment by kuschku | Hacker News Reader

Try this variant:

(link removed, see video below)

And tell me your parents/grandparents/etc will not mistake that for the real thing.

(you can enter whatever you want into the phishing form, it will just take you back to this post – but someone with less morals could do entirely different things)

EDIT: Video for mobile users (this page doesn’t work on mobile): https://cdn.kuschku.de/ServiceLogin/video.mp4

View on HN

Perfect example. Everything that I can see in my cell looks right, including informations from the green padlock, just opening (and understanding! ) the whole URL would make one NOT enter the password.

And that’s the thing, thanks to Let’s Encrypt, the padlock on the fake site also stays, everything looks normal.

If you now also register something like accountsgoogle.com or a similar page, people likely wouldn’t even notice.

This is like it’s made for phishing.

Ironically, Chrome is now blocking that as a phishing site!

Yes, and now I have to deal with Google to unblock it.

One of the reasons why I hate automated systems judging things.

Thanks, Google...

Please tell me this is sarcasm. The system is working...

The system would be working if it was an actual phishing page.

If it is an example, which is non-malicious, and even says "Don’t enter your password", and doesn’t even store the data from the input fields, it’s not.

It could easily check if any JS is executed, or if the form fields ever get sent anywhere (both is not the case).

The only bit you're missing here is redirecting the user back to a Google page you do need to be logged in for, so they think everything is ok and don't think twice about what just happened

I was hoping I could avoid getting flagged as phishing site if I'd make the form ignore all content and redirect back here.

Turns out I was wrong.

Temporary: please take the page back, it worked for me... Keep the video for those who can't.

I can’t, it’s hard already to get rid of the phishing flag Google has set for the domain.

This is what I get: "Sorry, this page is not valid AMP HTML"

Do you happen to be on mobile? This particular site only works on desktop, at the moment. I’ll do a screenrecording for you mobile users in a moment.

https://cdn.kuschku.de/ServiceLogin/video.mp4

Yes, I'm on mobile. That must be it.

The sexism is really out of line.

Well, it wasn’t intentional (and I’m female myself anyway), but [long family story omitted] I edited it out.

Reply on news.ycombinator.com