Hacker News Reader

Comment by bduerst | Hacker News Reader

withgoogle.com is more of a 'sandbox' for Google one-off programs, labs, events, etc. which don't need to have the same branding guidelines as on google.com domain.

View on HN

...so?

It's still a phishing vector. Teaching users that sometimes Google throws together half-assed domains encourages them to trust any domain with "google" in it.

Just for example, the following domains are all available:

workingoogle.com labsgoogle.com labsatgoogle.com learngoogle.org learnatgoogle.com youatgoogle.com bygoogle.co securitywithgoogle.com mailatgoogle.com realgoogle.com

etc.

AFAIK they don't have any pages there that allow account login, for that and other security reasons.

Yes, but:

> Create a name and email — neither need to be real — to make this quiz seem more realistic. Don’t worry, this information won’t leave your device.

I'd trust this notice if I knew it came from Google, but since it was placed on a phishy-looking website, it really gave me pause.

https://www.google.com/search?q=site%3Awithgoogle.com+login

That doesn't help the situation much, even if it were true. If a phisher creates a fake Google domain, how many users will go, "Aha! I was about to login using my Google credentials, but then I remembered Google only asks users to login to *.google.com domains, so I know this is an attempted phish!"

Ask Equifax why this is such a terrible idea:

https://www.nytimes.com/2017/09/20/business/equifax-fake-web...

I assumed that I passed the test by not filling out the form

You're supposed to use whatever information you wanted the example phishing e-mails do be directed to. I used "Bob" and "bob@example.com".

I guarantee at least 25% of users used their real name and email.

Reply on news.ycombinator.com