There was a short time about seven years ago when Google was returning a malicious link for Blizard's BattleNet. Had my WoW creds stolen and I wasn't what you would call naive on a computer.

It is important to remember that phishing works against even experienced and savvy users who know about phishing, and that effective countermeasures for these types of attacks do not include “replace users with smarter users”.

Perhaps it's time for software companies to invest in human genetic engineering, to improve the next generation of users.

That sucks.

I know it's a tired point, but it nevertheless amuses me that someone would search for BattleNet. The name is literally the domain name: battle.net.

This is not a very clever point. Plenty of things used to be caller "somethingnet" in order to advertise their ties with the internet. It was never about a tld. Kind of like how having "block" or "chain" in your app's name makes you "cool" nowadays.

I wonder if it was to associate with the internet or with Microsoft branding.

Microsoft went apeshit and called all their products .NET in the early 2000s. The branding was all over the place so I could see how calling your product *net might get you installs by association.

Ok but there's no way to know that without searching. Unless you have one of these https://mobile.twitter.com/PulpLibrarian/status/844278365590...

I mean, you could guess. The name even hints at it for anyone aware of the `.net` tld.

That's not a great solution, since many people are barely aware what at url is, but I think it should still be one that you and I (as people who are) use.

Similarly the article is fixed by guessing that google chrome is probably at chrome.google.com (also chrome.com), firefox is probably at firefox.com, cnn is probably at cnn.com, gmail is probably at mail.google.com, gmail.google.com, or gmail.com (actually all 3), hacker news is probably at hackernews.com (oops), etc.

> I mean, you could guess. The name even hints at it for anyone aware of the `.net` tld.

Which also risks ending up on the wrong site (e.g. Steam is not at Steam.com). I'd trust Google to know the correct URL more than my guess.

Steam isn't at steam.com, but there also isn't a phishing site for steam at steam.com, and if there was you can bet that valve would do something about it.

Basically I'm trading Google/Bing and ads known to be malicious, for ICANN/registrars, self interested companies, and a reasonably functional "legal" system. Edit: And less tracking, and faster access to websites.

But what if you guess chrome is at chrome.com, and that turns out to be malware?

Guessing domain names is even worse than Googling.

and using news as a third-level domain is a poor choice: Lynx always thinks I'm trying to open an NNTP connection :(

That .com trick works mostly if you are american going on american websites mostly. You seem to be unaware of other tlds.

Point of interest: Chinese websites are expected to use the .com TLD. China technically has its own TLD, .cn, but using it is not normal.

.com is pronounced 网 wǎng, "net", which doesn't leave much conceptual space for other TLDs.

The name is not even BattleNet. It's literally always been branded "Battle.net"

This was soon after the switch to battle.net and I may not have realized that the address was actually 'battle.net'. I don't remember. Honestly, I still search from time to time even when I know the address (didn't back then) because sometimes it's fast, and sometimes it's just muscle memory.

That's not an assumption you can make in general. For example, paint.net is not found at paint.net.

It's serving it up today. Fourth link on my Google results for "chrome" is for softonic which is malware