News for hackers. Stuff that matters.

A comment on Gmail spam-filters PayPal security messages. Parent comment

Re:Gmail spam-filters PayPal security messages by cm2187 on Wednesday February 06, 2019 @05:52PM (#19100966)
I recently received an email claiming to be from paypal (the SPF+DKIM passed) but inviting me to click on links in "epl.paypal-communication.com". How do I know this is not phishing? It certainly looks like phishing, and I certainly wouldn't click on those. But if it is not, how stupid must these guys be to use "paypal-communication.com"?
[ Parent | on HN ]
Re:Gmail spam-filters PayPal security messages by AstralStorm on Thursday February 07, 2019 @06:27AM (#19104526)
How do you fake DKIM though? That is as good as a TLS certificate.

I suppose someone might've taken over your browser or email client, but then it is game over anyway.

Perhaps PayPal should start MIME signing whole messages...

[ Parent | on HN ]
Re:Gmail spam-filters PayPal security messages by cm2187 on Thursday February 07, 2019 @07:30AM (#19104784)
Which is why I think it was rather a moronic choice of domain on the part of paypal. But I know how to look for spf/dkim validation. A normal user (or a user using a mobile/tablet) will make a decision purely on the domain of a link.
[ Parent | on HN ]
Re:Gmail spam-filters PayPal security messages by bduerst on Wednesday February 06, 2019 @06:23PM (#19101222)
Whois says it's owned by Paypal on MarkMonitor, but that can be faked, right? Or does MarkMonitor require email address validation? ([email protected] in this case)
[ Parent | on HN ]
Re:Gmail spam-filters PayPal security messages by cm2187 on Wednesday February 06, 2019 @06:48PM (#19101438)
Correct. But even if the whois wasn't fakeable, do I really need to run a whois before I click on a link in an email?
[ Parent | on HN ]
Re:Gmail spam-filters PayPal security messages by bduerst on Thursday February 07, 2019 @08:58PM (#19110726)
Almost like we need an ssl-like authority for email now. Ugh.
[ Parent | on HN ]
Re:Gmail spam-filters PayPal security messages by jakejarvis on Thursday February 07, 2019 @01:23AM (#19103427)
MarkMonitor specifically is pretty picky about only taking on large-scale corporations (google.com, amazon.com, microsoft.com to name a few) so just the fact that it's registered there is usually a reliable way to confirm legitimacy, but checking whois is still way more research than an average PayPal user should need to do to avoid being phished.
[ Parent | on HN ]
Re:Gmail spam-filters PayPal security messages by TheRealPomax on Wednesday February 06, 2019 @08:11PM (#19102006)
you forward it to [email protected], and then get a response pretty quickly telling you whether it was phishing or a real email.
[ Parent | on HN ]
Re:Gmail spam-filters PayPal security messages by stev0lution on Thursday February 07, 2019 @04:26PM (#19108748)
Sadly, I don't think so: https://cantoriscomputing.wordpress.com/2017/03/04/paypals-e...
[ Parent | on HN ]