Hacker News Reader

Comment by zaarn | Hacker News Reader

Examples from what I've seen:

    https://account:paypal.com.login@verified-account.com/phish

This, to the untrained eye, might at first glance look like a paypal.com link. In fact, it belongs to verified-account.com and it abuses the capability of URLs to contain a username and password to make it look legit.

View on HN

Wow, I knew Firefox warns for these by default so I thought nobody would ever use this for a phishing attack anymore but it looks like Chrome just meekly follows the standard. That's too bad, really, this is a very easy way to create very realistic phishing mails.

Don't even need that account: at start, this works in chrome:

https://www.paypal.com@google.com

In Firefox it tells me:

    You are about to log in to the site “google.com” with the username “www%2Epaypal%2Ecom”, but the website does not require authentication. This may be an attempt to trick you.
    
    Is “google.com” the site you want to visit?

Gold star for Firefox! That's an excellent feature.

From the error message it sounds like if this was an attacker controlled site configured to require authentication it wouldn't trigger? If so it's not that useful a defense since whether to require auth is entirely under the attacker's control.

Reply on news.ycombinator.com