News for hackers. Stuff that matters.
Re:Submit Your Claim in the Equifax Breach Settlement by rhizome on Thursday July 25, 2019 @02:47PM (#20528219)
It's only a problem if the authority is obscured by an unrelated domain name. If the page was a location on a site with known authority, or a subdomain, it could be validated much more easily. Unfortunately, vanity gets in the way.
Re:Submit Your Claim in the Equifax Breach Settlement by astura on Thursday July 25, 2019 @03:13PM (#20528457)
Its not just vanity though, in these two cases "the authority" is the industry as a whole, thus many "authorities."

For example:

>OptOutPrescreen.com is a joint venture among Equifax Information Services, LLC, Experian Information Solutions, Inc., Innovis Data Solutions, Inc., and TransUnion, LLC (collectively the "Consumer Credit Reporting Companies").

>[annualcreditreport.com] is maintained by Central Source, LLC. Central Source, LLC is sponsored by Equifax, Experian and TransUnion so you have a single site where you can ask for all three of your free credit reports.

Re:Submit Your Claim in the Equifax Breach Settlement by saghm on Thursday July 25, 2019 @04:55PM (#20529609)
So why can't Equifax, Experian, Innovis, and TransUnion each set up a subdomain to redirect to this domain? Then they can each direct people to their own subdomain, and people can be more sure that the site they end up on is one that the respective company intends them to.
Re:Submit Your Claim in the Equifax Breach Settlement by rhizome on Thursday July 25, 2019 @05:19PM (#20529828)
I feel like the lack of this kind of thinking helps keep people dumb about what a URL looks like, so that phishing links like www.bank-of-america--interestpayments.com/your-account/secure.html keep working. The less people are parsing the few domains they really do interact with, in favor of specialty URLs for every little thing keeps it all confusing.