Is My Credit Card Stolen? (A ruse to educate people about phishing)

by AngryParsley • 16 years ago

88 38 16 years ago

ROFISH• 16 years ago

You know what, this is a phisher's dream. Even if we could trust this website for not saving the data, the connection is a regular non-secure connection, so all somebody would have to do is catch some open wireless connections or similar.

pquerna• 16 years ago

we have applied for an SSL certificate, from both GoDaddy and Comodo.

they are both 'pending', since apparently, having 'credit card' in your domain is suspicious: http://ismycreditcardstolen.com/anti-phishing.jpg

rlpb4• 16 years ago

I'm not convinced that this will help so much here. Assuming that victims won't be checking for SSL, getting someone to an insecure copy of the site will do. I don't see how this would be your problem, though.

Security is a strange beast.

AngryParsley7• 16 years ago

View the HTML source. The credit card inputs aren't part of the form. They're never sent across the wire.

rlpb4• 16 years ago

This doesn't matter. If the connection is intercepted, the credit card inputs suddenly can be part of the form.

carbocation• 16 years ago

Perhaps a keylogger's dream, but then I suppose you would have two problems. And regex would not be one of them.

arnoooooo• 16 years ago

Another way this could be a good scheme is if people trust it and start sending it as a way to educate people, and when it starts getting momentum, it is changed and does start recording numbers.

sbov• 16 years ago

I submitted no data and it still said I failed the test?

iaskwhy• 16 years ago

I guess you're not supposed to submit these kind of forms, even if empty.

AngryParsley7• 16 years ago

Nah, I'm just lazy and didn't write any JavaScript to validate the inputs.

Edit: yeah I would normally never use JS for validation.

sketerpot• 16 years ago

The form that you submitted contained no fields, only a submit button. It has no way of knowing that you didn't type in any data.

alexkay• 16 years ago

The meat of the site is this page: http://ismycreditcardstolen.com/check.html

generalk• 16 years ago

Interesting concept!

I'd remove the negativity from the start. Putting "This is a test, you have failed it" right in front of folks is an instant turn-off, and might lead people away from your page instead of to the helpful content below.

More bullet points. There's not a whole lot of text there now, but anything you can do to get the message across with fewer words is a win, especially when dealing with non-technical folks.

Under "look at the address bar", you have: A common phishing trick is to have a domain like amazon.com.not.ru, which steals your credentials when you try to log in. The actual domain in this example is "not.ru," but people often only check to see if the string "amazon.com" is anywhere in the address bar.

I'd change that to not use the word "string" since non-tech-folks don't parse that very well, and maybe include screenshots of an address bar containing the real Amazon.com and a phishing site disguised as Amazon.

Still though, good idea!

AngryParsley7• 16 years ago

Thanks for the suggestions. If you want to make changes, you can fork http://github.com/pquerna/darwintest .

Edit: I used the "you fail" message because I think it makes people more likely to remember it. I wanted to say something like "your credit card has been stolen. kthxbye." but that would have caused some false alarms.

It's hard to have a memorable message without it causing offense or panic.

Also on my TODO: add a counter for those who put 16 digits in the credit card field.

Extra edit: nfriendly: Thanks for the styling suggestion.

nfriedly• 16 years ago

On the same vein as the post above, a little vertical spacing between the bullet points would go a long way toward improving readability:

  li { margin:12px 0; }

batiudrami• 16 years ago

"If asked for your password, do not give it out. Real websites will never ask you for your password. (Login forms excepted, of course.)"

This is confusing, in my opinion. It's hard to explain the difference between a login form and a page asking for your password, so it's probably worth just leaving this out. Any phisher worth his salt makes the page asking for a password look like a login form anyway.

AngryParsley7• 16 years ago

You're right. It will be fixed whenever pquerna gets back from the Cassandra get-together.

rlpb4• 16 years ago

Could you perhaps write some Javascript to check the check digit and submit just whether it was correct or not? Then you could have some stats on how many people are gullible vs. just curious.

jxcole• 16 years ago

I tried to find a way to pass the test and couldn't. Could someone explain to me how to pass?

trjordan• 16 years ago

A strange game. The only winning move is not to play.

mdolon• 16 years ago

That's strange, e-mail me your credit card info and I'll verify it manually.

ck2• 16 years ago

How responsible is this if you allow the domain to expire someday - or your email gets hacked and a foreign party takes control over your domain name?

jcooney• 16 years ago

This is remarkably similar to the site my friend Leon set up, which he artfully called "Creditcardology" - see http://secretgeek.net/cco/CCO.HTM

daleharvey• 16 years ago

I havent particularly been following it, but is there any real solution to phishing? with punycode domains and arbitrary tld's, along with characters that look the same in a lot of fonts, l and I, people need a cs degree to figure out if they are being phished.

I guess paypal and a small number of verified payment processors, (or real online banking) are about the only option.

AngryParsley7• 16 years ago

Single-use credit card numbers (and one-time passwords) would help a ton. Multifactor authentication of any kind would also be good. The problem with all of these ideas is that they're harder to use than fixed CC numbers and passwords.

I do like the convenience of being able to memorize a password or CC number though.

neurotech1• 16 years ago

Yes, Use bookmarks on a trusted computer or better yet type any sensitive domains. Typing www.paypal.com is easy.

arantius• 16 years ago

Yes, and it's very simple. Don't type anything important unless you also typed the URL into the address bar. Plenty of real mail from reputable, very phishable, sites actually say exactly this in their real emails-to-customers sometimes.

Laziness, of course, is a problem also.

mahmud• 16 years ago

1) Create an online form that doesn't take input, and call it "educational".

2) Get a bunch of educated people to review it for 3-5 days and approve of it.

3) Wait until the educated people send links of this to their non-internet literate friends, for education, shits and harmless giggles.

4) Switch to a live form that captures data.

JangoSteve• 16 years ago

5) ...

6) Profit

AngryParsley7• 16 years ago

Clever idea, but it's not hard to find out the identities of those behind this site. They'd get busted for fraud pretty quickly.

abentspoon• 16 years ago

Last week, I posted something similar to proggit using the youtube redirect exploit.

During its three-hour run, nearly 6000 people (20%) tried to give me their google account credentials.

http://www.reddit.com/r/programming/comments/bpy7h/think_you...

mixmax• 16 years ago

I'll mail this link to my mom right away.

dzh• 16 years ago

Aha! Online credit-card-information catcher?

m0tive• 16 years ago

The site's started to hit Firefox's "Reported Web Forgery!" page...

"This web page at ismycreditcardstolen.com has been reported as a web forgery and has been blocked based on your security preferences."

kunley• 16 years ago

They are banned now...

So anti-phishing folks got accused for phishing. Looks it was technically nice idea but terrible user experience.

Unless of course there WAS a hidden agenda here.

goodmitton• 16 years ago

Okay, that explains why I couldn't understand what you guys were talking about and all I got was a "Warning: Suspected phishing site!"

Is My Credit Card Stolen? (A ruse to educate people about phishing)

Related Stories