Re:The .zip TLD sucks and it needs to be immediately revoked
by psacawa on Friday May 12, 2023 @04:32PM
(#35921965)
The website can further strengthen the illusion of interacting with the FS by using HTML+CSS that imitates the browser's builtin file browser. It knows what it might look like by examining User-Agent and Accept-Language headers.
Re:The .zip TLD sucks and it needs to be immediately revoked
by benatkin on Friday May 12, 2023 @05:15PM
(#35922519)
Anyone can do that now.
<a href="https://anydomainname.com/">financialstatement.zip</a>
If it's an HTML email, you could potentially fake the attachment area with or without a .zip TLD, just by adding a carefully constructed image.
Re:The .zip TLD sucks and it needs to be immediately revoked
by thefifthsetpin on Saturday May 13, 2023 @05:01PM
(#35932672)
That's not going to get through even the most rudimentary anti-phishing filters, and at least some email clients still hint to you what's going to happen when merely hovering over that link.
For example, we receive a phishing email which reads "This is the bank with your financial statement attached. It's a password protected zip file encrypted with your online banking credentials for security." We click to download and end up at https://financialstatement.zip, where a JS prompt asks us for the decryption password. We think we're interacting with the file system and get owned.
Crucially, i) some browsers don't display the URI scheme in the address bar, and ii) people are used to the idea of a password-protected zip file, and iii) people are used to opening files with their browser.