At smaller firms, IT security training often consists of sending phishing emails, and trying to get employees to somehow navigate the (literally) dozens of TLD’s that outsourced company functions use for official company business.
I get the impression most industries are moving this way (by outsourcing everything they possibly can to *aaS).
I don’t understand why it has to be https://company.subcontractor.com, and not https://subcontractor.company.com
There’s probably a depressingly large and profitable industry waiting to be invented by the person that solves that problem.
From what I can tell, AMP email is a step in the other direction: run JS and active content as the email loads, presumably from an unauthenticated sender, and no https padlock that users already understand.
Which is particularly funny because amp URLs have also become a major tell for spam. Want your sketchy sign-in page to come from a legitimate-looking domain? Just set it up with AMP and all the "check the pre-.com URL" rules people know will completely fail them!
I wonder if AMP for email will produce the same hell of broken redirects that it's created for webpages?