Launch HN: Riot (YC W20) – Phishing training for your team

Re:Launch HN: Riot (YC W20) – Phishing training for your team by closeparen on Tuesday March 24, 2020 @11:21PM (#22681683)

I don't think it's realistic to live in constant fear of browser sandbox escapes, or to consider visiting an arbitrary URL "silliness." If your threat model includes people willing to burn Chrome 0-days on you, you need an air gap.

The much more relevant battle is preventing credential theft, which you can solve completely at the technical level with U2F. And if you can't, user education on "check the URL before typing your password" is a little more realistic than "don't open links from email ever."

[ Parent | on HN ]

Re:Launch HN: Riot (YC W20) – Phishing training for your team by anitil on Thursday March 26, 2020 @08:29PM (#22699402)

While I agree with you, I'm far less concerned for my family/friends/colleagues about a sandbox escape compared to accidentally putting information in to a malicious site

[ Parent | on HN ]

Re:Launch HN: Riot (YC W20) – Phishing training for your team by closeparen on Sunday March 29, 2020 @04:05PM (#22722210)

Yes, and "consider the URL and how you got there before typing in your password or credit card" is a lot more realistic than "don't click links." Still, clicking the link fails the phishing test all by itself.

[ Parent | on HN ]