News for hackers. Stuff that matters.

A comment on The closest I've ever come to falling for a Gmail phishing attack. Parent comment

Re:The closest I've ever come to falling for a Gmail phishin... by IanCal on Wednesday January 11, 2017 @08:05AM (#13373622)
I'd say the data: url part is important, as it lets you construct much more plausible looking contents for the address bar. The standard "check it's google.com" would probably fail for a lot of people.

How many people really know that you can put a whole webpage in the URL?

[ Parent | on HN ]
Re:The closest I've ever come to falling for a Gmail phishin... by timruffles on Wednesday January 11, 2017 @08:08AM (#13373641)
Agreed - I think simply highlighting the data:... part of the URL with a vaguely scary colour would help.
[ Parent | on HN ]
Re:The closest I've ever come to falling for a Gmail phishin... by mayoff on Wednesday January 11, 2017 @10:17AM (#13374483)
Apple's approach in Safari is to only show the hostname in the address bar, unless the address bar has focus. This works pretty well in general (for non-power-users). Unfortunately, for a data URL, it just shows as much of the URL as fits. This may well include the phony “https://account.google.com” part of the URL and thus still mislead naive users.
[ Parent | on HN ]
Re:The closest I've ever come to falling for a Gmail phishin... by eridius on Wednesday January 11, 2017 @01:38PM (#13376287)
At the very least it'll still look different, which might hopefully make the user take a closer look. For example, for normal URLs, you never seen the https:// part (unless the address bar has focus). Even if you enable the advanced preference to show the full website address again, it still hides the https:// part.
[ Parent | on HN ]