Half of All Phishing Sites Now Have the Padlock

Re:Half of All Phishing Sites Now Have the Padlock by medmunds on Wednesday November 28, 2018 @12:33PM (#18553505)

> email tracking links ... domains have nothing in common with the destination URL

The tradeoff has been CNAME-ing your own subdomain to your Email Service Provider’s tracking domain, which gets you a recognizable(-ish) URL, but has historically prevented https links, or using the ESP’s tracking domain directly, which allows https but makes sketchy-looking URLs.

I’d think Let’s Encrypt would make it possible to offer https on white-labeled (CNAME’d) tracking domains. Seems like an opportunity for some enterprising ESP.

(Yes, two other options are not tracking email links, or running your own tracking. I’m going to assume these are not realistic for most marketing departments.)

[ Parent | on HN ]

Re:Half of All Phishing Sites Now Have the Padlock by antsar on Thursday November 29, 2018 @10:36AM (#18560926)

> I’d think Let’s Encrypt would make it possible to offer https on white-labeled (CNAME’d) tracking domains.

Technically, Let's Encrypt is not unique here. AFAIK, most CAs allow subdomain certs (and only validate ownership of said subdomain, not the top-level domain).

Let's Encrypt just makes it scalable financially.

[ Parent | on HN ]