Google needs to add some optional intelligence to Chrome so that when it comes across a site with suspiciously similar design as key google urls by on a unrenognized url, it should warn the user.
> “We are approaching the point in this case where there are only two reasons for why people say there’s no good evidence,” Rid told me. “The first reason is because they don’t understand the evidence—because the don’t have the necessary technical knowledge. The second reason is they don’t want to understand the evidence.”
Is there anywhere we can see this evidence? Objectively I'm curious how an attack which consisted of basic phishing was determined to be definitively supported by the Russian government.
If they broke SHA-256 or coerced a Russian CA to generate a Google certificate, I'd agree... but using bitly and decades-old "click this link to reset your password" links? Come on.