Hacker News Reader

Comment by pchristensen | Hacker News Reader

Wow, I don't like this. My usual tactic of looking for the / after the .tld isn't a general solution anymore. I hope my bank doesn't implement this functionality.

View on HN

So it is important to also check the URL in your address bar _after_ you click, as well. This trick won’t be able to fake that.

But would you always catch it if you were redirected to www.youtube.com.you1ube.com/something?

Or possibly worse - http://www.youtube.com⁄bad-site.com/something_else

In this I rely on my browser to filter deceptive characters in domain names.

When I hover over the link you gave (or click it and see it in the address bar), it looks like http://www.youtube.xn--combad-site-hx3f.com/something_else (which lets off plenty of flags for me).

When hovered, then clicked in Opera:

opera:illegal-url-24

Error!

Invalid URL

The URL http://www.youtube.com⁄bad-site.com/something_else contains characters that are not valid in the location they are found.

The reason for their presence may be a mistyped URL, but the URL may also be an attempt to trick you into visiting a Web site which you might mistake for a site you trust.

Exactly! Imagine if your bank had such a redirect URL available, Phishing would be so simple.

Some banks display a customer preselected image after the user name & before entering a password. This seems to be a good solution to phishing if one keeps the username private. Otherwise a site could give you the option of using two part passwords.

... and a study a while back showed that, if you simply don't show that image, a large majority of users don't notice. For this reason, the whole "sitekey" phenomenon strikes me as a waste of time.

This? http://usablesecurity.org/emperor/ - it is an interesting read.

It should also be noted that it's not even a 25% benefit for them, but it does help security, even if slightly. I think lowering phishing 1% could be massive for any major bank.

Isn't this incredibly simple to defeat? The phishing site can send your username to the real bank's website and retrieve the image.

If you do that, the bank will notice a bunch of connections from the same IP for different usernames.

You could use a botnet to do the lookups, but that still makes the attack substantially more difficult.

Reply on news.ycombinator.com