Hacker News Reader

Comment by cbanek | Hacker News Reader

I missed two: the "allow some random person to read your email" which I would never click on, and the one that had a PDF, even though they don't allow you to do anything with it. Just because someone sends you a PDF doesn't mean it's an attack vector. It would have been more helpful to say something like "this is someone you do business with as well, or someone you've never heard of." (which I find to be more useful signal on if I want to look at an attachment, though even if they are someone I know, do they have a reason to send me that PDF is the second question). Unsolicited attachments are always suspect.

View on HN

And that's the rub: knowing what's phishing depends on who you are. Receiving a PDF with financial data has a completely different probability of being an attack if you know who the sender is and were expecting them to send such a file today.

Also, assuming that a message is phishing is usually not harmful in any way. If I got an email from dropbox.com (and were a Dropbox customer), I'd ignore the email, and just type "dropbox.com" in my web browser to see what's up. If you're paranoid, you don't need to be super smart about what exactly is phishing.

This isn't a fair test.

This is exactly what I do for any kind of account stuff: never click on the email, always just sign into the website itself and look for the message. I really like the companies that just say "sign in and see a new message" or whatever, rather than, "click on this link."

PDF's especially are pretty low risk. They normally open with the in-chrome PDF viewer, which is sandboxed pretty much as well as web pages, so you would need two zero day exploits (since chrome generally auto-updates within a few days of an axploit being published) in addition to tricking them into opening the PDF to get into someones device.

Same with Firefox. In fact, I rarely open PDFs outside of Firefox, and when I do, it's either in Edge (if I'm on Windows) or Evince (on Linux). I never use Abobe Reader, so there's very little chance that I'll get attacked.

And yes, I failed that question because I assumed that it's information that I was expecting. I don't open PDFs unless I am expecting it, because who wants to spend the time waiting for it to download and render for something that's likely spam?

On the PDF one, it tells you in the "intro" blurb that the sender's email address is wrong. Should be .edu and it's .org.

Ah thanks, I must have missed that. If it's the wrong address then definitely suspect.

I don't know if that would be enough in real life for me. I know some organisations use two different domains (e.g. they did a transition but they don't want to turn off .org just in case something still uses it, the IT team forgot that Sam has two Outlook profiles, one is on .org).

And while pdfs can be attack vectors, they're not an especially strong one - it's not like running an exe with administrator privileges.

Comparatively giving a third party access to your emails should definitely raise flags.

They even had a legitimate example, of Dropbox sending an email from dropboxemail.com.

I honestly think this should never be done because users shouldn't be expected to know which domains you do and don't own.

Your first point is definitely correct - their guide is confused at best.

As to your second point, I agree in terms of 'best practices', but in terms of teaching about phishing, the fact is, companies do use multiple domains (and some deliverability guides actively encourage different domains for marketing emails and transactional emails - companies should use subdomains for this, but not all are that savvy).

Given that companies are sending from multiple domains, I think the litmus test for phishing is:

"Is the email trying to get me to give me information? E.g. a login on the wrong site, sending card details or anything like that"

Your pdf reader should allow you to open a pdf without being compromised (just as your browser should allow you to click a dodgy link without being compromised). So I think that item should pass the litmus test (unlike the email reading one).

I took that to be a hint along the lines of "schools should have .edu domains", which is unrealistic; lots of academic institutions use non-.edu domains, for better or worse (in fact, the school district in which I attended uses (DISTRICT).net to this day, and (DISTRICT).edu isn't even registered!).

If that blurb was meant to be taken as "You happen to know that your school only has a .edu domain", then yeah, this would have been conclusively phishing. Otherwise, just because it might be malicious doesn't mean it's phishing.

On my phone, I didn't see the TLD, and depending on the type of school, a .org is completely reasonable (e.g. private school). In fact, the types of schools I would be interested in a financial report from would potentially not use a .edu TLD.

And PDFs are mostly harmless if you don't use Adobe Reader, since it's either a small attack vector or in a sandbox.

That's a very US-centric view.

The PDF one seemed like a pitch for using Chrome as your PDF viewer.

And yet if that's what you already normally do you would've "failed" that question for correctly identifying it as not actually phishing.

And they completely failed to mention that Firefox and Edge also have built-in PDF viewers (I don't know about Safari since I don't use it).

Reply on news.ycombinator.com