Hacker News Reader

Comment by beamatronic | Hacker News Reader

What if you just don't click on any links in email? Particularly if they are really important sites. Just accomplish the proposed task another way. For example, if you get an email from Paypal, stating that you need to update a credit card or something, don't click their link, instead open a browser and enter "https://www.paypal.com" yourself, and go into your account information and look for your saved payment methods.

edit: typos

View on HN

Our government (Netherlands) doesn't provide links in emails. They even don't provide the domain name (which can be turned in to a link by the client), but refer to the website with the name of the website.

For example:

"There is a new message in your inbox on MijnOverheid. Please visit MijnOverheid to read this message."

And every time they also warn that they never will provide any link in any email.

I would be great if more (all) websites start doing this.

Unfortunately they also have a habit of moving the login form around, especially the one related to business taxes.

The only time I click on links in emails is when I've just requested them. Like I've just set up an account and it says it is sending me an email to verify the address. If it is some email out of the blue I would never click the link or open the attachment. I actually enforce the attachment rule by configuring my mail client to only support "save" as an option for attachments.

A good way to get a lot of people with a phishing attempt is the 'Unsubscribe' button in an email.

Could you expand upon this? Do you mean the unsubscribe takes you to somewhere you need to then sign in with credentials to "unsubscribe"?

They could put whatever is most effective at the destination of that URL. Once you're visiting a URL crafted by the attacker, you're already in deep trouble. Often that's all it takes, merely visiting the URL.

If you assume people have the attention span of gnats, I guess.

If I'm clicking a link to unsubscribe you're not going to get me to start entering personal information.

Crafted-content UAF vulns are still occasionally being found in browsers.

To say nothing of unpatched/non-updated browsers.

You don't need a trick URL for those.

The point is that simply clicking a dodgy link can, in some cases, own you. No credential acquisition required.

Yes but what does that have to do with the article?

Are you asking what a dodgy URL has to do with the article?

If they get you to click on a link, it doesn't matter what it looks like in the address bar. So what does a malicious link that could be on any domain have to do with domain spoofing?

If you hover over a link in a browser, the URL of the link will be shown as a tooltip, or in the bottom of your browser window.

I've definitely seen websites that require you to login to unsubscribe. It's probably illegal (https://arstechnica.com/tech-policy/2012/09/log-in-to-unsubs...) but I still see it from time to time. Usually I just mark them as spam and don't bother logging in.

It's also super annoying when someone has accidentally entered your email address instead of their own. When you try to unsubscribe, you're asked to log in to an account that you never created.

On many sites (that have more than a simple newsletter), the email preferences are part of the account settings where you do things like change your password, avatar, possibly manage your billing information and shipping address, etc. You wouldn't want any random anonymous person to be able to access that info, so of course it requires logging in by default. While those systems should ideally have one-click unsubscribe functionality nowadays, there are probably quite a few that don't.

This is a good use for bookmarks, too.

What about links on websites? Do you also not click those?

If it's to my bank or email account, no, for the same reasons.

I meant it more as a rhetorical question: even if you really don't click on any link to any of your important accounts _ever_, you are still vulnerable:

- if you install a malicious browser add-on (or if the guy behind one you already have gets phished and pushes a malicious update).

- if any other part of your system/browser ever gets compromised.

- If you mistype the address and your browser searches on Google/bing instead you can be phished from the ad links at the top.

If you have a malicious browser add-on or your system/browser is compromised, you're pretty much pwnt, aren't you?

The only hurdle left would be TOTP or Yubikey.

I always hover over links before I click them to see where they actually lead in the status bar. It is less safe than your suggestion (since if I'm not careful I can fall for "googel.com" or "goog1e.com"), but is still often useful (even just to avoid going somewhere I'm not interested in going, not specifically against phishing).

This does not work if the link is in a browser translating punycode, i.e. if the URL is in gmail or as in this example in a web article, hovering over the link shows the translated punycode, i.e. apple.com.

If you're in Firefox, about:config, search puny, change that from false to true, NOW when you hover over this URL you'll see the untranslated punycode which is the real URL.

In mobile chrome at least, the xn-- URL showed up when long pressing instead of the apple one. Once clicked, it rendered as apple

I think you skipped reading the article.

The article is about punycode. Using it, you can have a site name like 'apple.com' even though really the domain is made up of various unicode characters.

So even if you were exceedingly careful and you made sure not to fail for googel.com and goog1e.com, you would still fall for the visually correct google.com.

The status bar is completely worthless and unreliable from a security standpoint unless you disable javascript. javascript can intercept your click and navigate you anywhere it wants.

Reply on news.ycombinator.com