Plead HN: Please be careful with your information

https://news.ycombinator.com/item?id=2000627

by icey • 16 years ago

93 75 16 years ago

news.ycombinator.com

There is an active Hacker News contributor currently making plans to phish Hacker News and reddit because "there is this 'smug' attitude on HN about HN'ers being 'better' than your average computer user in this respect".

Please be careful when filling out forms that contain any personal information or passwords. There are people out there who are looking to shame & ridicule you (and worse).

There's no need to mention any names, because it doesn't really matter who the threat comes from.

To the user hatching this plan: Consider this an antibody to your plan. If your theory is true, then this posting won't make a difference anyways and you'll have the chance to shame all the people you want.

[Edit: I had genuinely hoped to avoid turning this into yet another cult of personality thread on HN, and unfortunately that's failed. I don't think there was an intention to cause financial harm; but I do believe there was the possibility of harm to reputation given the information I had available.

There was an email that was evidently sent out to many HN users today discussing this plan; but I have not been privy to that email.]

DanielStraight2• 16 years ago

I avoid phishing with some basic rules:

1. Never give passwords to a third party (so, for example, no Mint).

2. Never give anything more than an email address to someone you wouldn't also give your credit card number to. I only give an address or phone number when I'm planning on buying something.

3. Never log in after following a link. Always log in by manually (either through typing the URL or a bookmark) visiting the site.

jey• 16 years ago

Can you explain (3)? Isn't it enough to check whether you're on the right domain before logging in? Or is this to prevent logging in at an IDN URL that looks like the real URL?

DanielStraight2• 16 years ago

Domain check is good, but can be misread, especially with IDNs. Of course, URLs can be mistyped too and a lot of phishing is based on typos of URLs. So really, in the end, you should always follow a bookmark before logging in.

subbu• 16 years ago

I fell for this trick with twitter-alike url. 2 things did it for me. The link was from a friend of mine (of course he didn't know that was phishing site). And, it was a replica of Twitter. To make things worse it was shortened using bit.ly. I realized I made a mistake only after I entered password and hit submit. I quickly logged into twitter and changed my password.

reduxredacted2• 16 years ago

There's various reasons that #3 is particularly useful, though I think the original writer was probably more concerned with links in e-mail or links on sites other than the site you're being asked to log in to (such as links from advertisements or other third-party sites):

1) Similarities in the way letters look in certain fonts can cause you to think you're on the correct site when you are not. This is mitigated by EV SSL usually, but if you're not paying close attention you might miss it.

2) Browser exploits (though I'm unaware of any specific ones in current browsers) have commonly focused on tricking the browser into displaying one URL when the page is actually being hosted by another.

3) Links in e-mail, specifically, asking you to "login and update your information" (or "login and sign up for paperless billing now!" is pretty common, especially when combined with some perk). Often these links use redirection to gauge effectiveness of the e-mail campaign, so it's common for the link to look strange. If the e-mail is a phishing attack, that redirection could include code injection resulting in you being sent to the right URL to login, but with malicious code inserted to capture credentials or do other fun and exciting things. Of course, the site would have to have some existing XSS vulnerability on the login page, or the code would have to be attacking a browser/plug-in vulnerability, for you to see the EV SSL indicator properly in the address bar.

The last point is also usually mitigated by extensions like NoScript in Firefox.

jacquesm14• 16 years ago

Excellent rules and I really think those ought to be pasted to the front of every monitor of everybody that ever fell for a phishing scam, and preferably to the front of the monitors of those that have not yet fallen victim to one too.

meterplech2• 16 years ago

I was wondering about the no use of Mint. This post (by mint itself) says that they don't store passwords and only provide a read version of your data. http://satisfaction.mint.com/mint/topics/is_my_data_safe_wit...

Could you/someone who has more knowledge of this than me explain how this is safer (if it is) and then possibly explain if/how someone could hack mint to get my information.

I always thought of mint as just as safe as using online banking, is this very flawed?

abraham• 16 years ago

Mint stores you passwords. As with anything you are increasing risk by adding a third party to the equation.

MisterWebz2• 16 years ago

Sounds like this guy has way too much time on his hands. And what did you mean by "his theory"?

noodle3• 16 years ago

i think his theory is that HNers and redditors have a more elitist attitude about themselves and their tech skills, but will fall for the same basic traps as their grandma. (or, thats what it sounds like to me)

weaksauce• 16 years ago

This community on average is more technical than most but that is just aggregate statistics. I would say that in any community you are going to get x% that would fall for a phishing scam.

aerique• 16 years ago

Sounds like a reasonable theory. All it takes is a moment of carelessness or not being up to date to the latest exploit.

That said, we do step into fewer digital traps than a less technical person.

micheljansen• 16 years ago

Good idea, as long as it is only to demonstrate proof of concept (or in this case, opinion). Better be pointed to your own failures like this than wait for someone with more malicious intentions :)

citricsquid• 16 years ago

I assume his idea is "hey hackernews do you like my startup please sign up to try it out" and then (edit: after signing up) the login page will have a "server error" when you try to view the idea and that way he doesn't have to build a product and won't attract suspicion. "oh sorry you hammered my server, it'll be back later today".

tptacek3• 16 years ago

No, it's dumber than that.

reduxredacted2• 16 years ago

Wouldn't this be mitigated by not using the same login information on the startup site?

levesque• 16 years ago

Has 4chan got the black eye for HN/reddit?

maxklein2• 16 years ago

Is the solution to all this not Facebook Connect and Google Login?

lonestar• 16 years ago

No, indeed it is not. If the problem is that people are getting phished because they type their info into a spoofed login page, how would making one standard login page be the answer?

tallanvor• 16 years ago

Well, I for one don't want all of my accounts linked together. I don't think that's information that Facebook or Google needs.

axod• 16 years ago

Definitely! Lump all my logins into a single point of failure, so that if something is compromized, everything is!!! Awesome idea. :/

maxklein2• 16 years ago

It's also a single point to defend.

swombat4• 16 years ago

So, wait a minute... jacquesm contacted you with an idea for a relatively harmless experiment (I was contacted too, so I know what it was about), and your response was to post it all on HN without even talking to him first?

wwortiz• 16 years ago

It seems that icey did not think it was so harmless and wanted to inform the community in case any malice was involved. If this experiment was completely harmless I don't see why the contributor needed to contact so many people (as it seems they contacted quite a few active members from the comments) in order to perform it.

swombat4• 16 years ago

Knowing what the phishing in question was, yes, it was pretty harmless. Even if it was not, jacquesm would not risk his reputation in doing something malicious to the HN community, so this is a case where a private email might have done the same as this public notice.

I'm not saying anyone here did anything terrible, but usually when contacted privately you first respond privately, so this is a bit out of order. It's not like jacquesm wouldn't have listened to arguments about this, and so an immediate action in the form of this post is, well, just bad form.

Edit: jacquesm has come forth with it, so I've replaced "a contributor" with his username.

jacquesm14• 16 years ago

Or, the reverse, exactly because it is known to quite a few members, if there were any malice in it that would have never happened. And then icey would not have been able to spill the beans.

icey8• 16 years ago

No, he did not contact me about it at all. It was being discussed in irc. I told him I thought it was a terrible idea there, but since it was still being pursued, I posted here.

swombat4• 16 years ago

Being contacted on IRC is still being contacted.

tptacek3• 16 years ago

Isn't this a better conversation for email?

rl1987• 16 years ago

To avoid giving out too much information about myself on the web, I try to follow these rules: 1. Never give my actual name or address unless I'm intending to buy something. 2. Unless the website looks fairly reputable, I register with wh4f.org throw-away email account. 3. Third parties have no need to know any of my passwords. 4. Nigerian prime ministers don't contact random people on the internet.

crocowhile• 16 years ago

It has already happened on reddit last week. Someone came to /r/favors and offered a free premium account to a file hosting website he had just built. The deal was: you open an account on the website, you PM'me your username and I'll make it premium. Of course he got a load of users giving him data and then disappeared, along with the website.

Any other "HN Rate my webapp" thread could do the same.

There are ways of hashing nice password with custom-modified algorithms and bookmarklets. Use them guys.

NathanKP• 16 years ago

I don't think that it would be possible for me to fall for a HN phishing attack seeing as how I don't even have a password with HN. I logged in over a year ago using one click authentication linked to my Google account. The only way I could theoretically be effected by a phishing attack would be if the attacker somehow logged me out, then made a page which tricked me into thinking that I was clicking on HN's one click login.

jacquesm14• 16 years ago

So, time to own up then, it seems the cat is firmly out of the bag, apparently icey thinks the chances of success are better than I do ;)

The evil part in me could not help but wonder about how everybody seems to be so psyched about receiving a chrome notebook that they throw caution to the wind and enter anything and everything in to a form on some server somewhere allowing the google marketing department to significantly update their profiles with all that data they supply, and all that for the chance of getting a laptop.

This sort of action is a very common marketing tactic, but I was actually quite surprised to see how popular it was on HN. Also, the fact that google was happy to collect your information even when you can't receive the notebook was an interesting detail, and lots of people only realized that after filling out the form.

Then the other day a second thing happened, someone solved the contest that was embedded in the video that was used for the launch of the product.

The evil part of me again thought wow, what a large amount of work that was done here, I wonder how people would respond to a second contest, with a much larger number of notebooks to be won?

So, within a few minutes a plan was hatched, a simple idea to see how susceptible a security conscious community is to stuff like this. The domain is plainly in my name and just about all the tell tale signs of a phishing scam are present. Over the course of the last couple of days the text was polished to make it more clear what the intent is.

The url of the site is http://www.freechromelaptop.com/ , the url of the payoff page is http://www.freechromelaptop.com/process.html

Since I'm the main 'driver' behind this little prank I take full responsibility for it and for the fall-out if any, the other co-conspirators would have never done this without me asking for it.

I hope you'll forgive me for having a devious side to me, but I intended for nothing but good to come out of this, and I hope that even if the project never got underway that you will take these words to heart, please be very careful with what you fill out in online forms, even if the page looks genuine and it is google that is giving you a chance to win some laptop you have to wonder if the collective value of the information given up does not exceed greatly the value of the goods they are shipping.

  Jacques

J3L2404• 16 years ago

Results?

ScottWhigham• 16 years ago

Oooooh - well done! I love the "How many Google Chrome laptops do you want?" question :D

How many entrants did you get?

swombat4• 16 years ago

I imagine he got zero, since icey posted this post before he got it running.

bhousel• 16 years ago

This has been done already on HN.. s/freechromelaptop/wakemate/g

ZeroMinx• 16 years ago

Well done!

Shout next time you're in London and I'll buy you a beer! :)

thirdstation• 16 years ago

"I hope you'll forgive me for having a devious side to me, but I intended for nothing but good to come out of this ..."

People don't like being duped, even if it's for their own good. You're likely to get more "f--k you's" than "thank you's".

If you want to teach someone a lesson, you don't start out by telling them they are stupid.

To create some real, lasting value you could have created the app and then said something like, "Hey everybody! I made this fake marketing web app that will steal your information and show you how it's done step-by-step. If you want to see how web scams are done, follow this link: ..." Then make some fake Google accounts for people to use (instead of their own).

"... you have to wonder if the collective value of the information given up does not exceed greatly the value of the goods they are shipping."

+1 for that sentiment. If your info wasn't more valuable, they wouldn't be doing it.

Evgeny• 16 years ago

If you want to teach someone a lesson, you don't start out by telling them they are stupid.

I think it depends on the person. Let's consider two scenarios.

1. "Never fill in your details on suspicious sites."

2. "You recently filled in your details on xyz.com. Now I know that your credit card number is 1234."

In response to (1) I would nod, but would it register deep enough? Not so sure. Now if someone actually shows me that he duped me into giving out sensitive details, I would be way more impressed and remember the lesson for longer.

gojomo• 16 years ago

I agree some HN users are overconfident, and education and even demonstration can be valuable. But, your experiment is quite literally a crime in many jurisdictions: obtaining identity information using false pretenses. You could be fined or jailed for such an educational 'prank'.

jacquesm14• 16 years ago

If i were to save the info in a useable form, then yes, but identifying information (names and email) was only saved as a hash, not as plaintext.

That of course makes it impossible to see if people enter fake information or not but I'd hate to give a bad guy the opportunity to hack the server and walk out with the info.

phpnode• 16 years ago

Icey, I'm presuming you knew that the point of the plan was to educate and remind us all that we're not immune from this kind of thing. So it's quite clear jacquesm had no malice here, if he did do you think he'd discuss it so openly? Since you've come out and spoiled this quite valuable opportunity, do you believe your post is in any way more effective at communicating the message than submitting the fake phishing site would have been?

icey8• 16 years ago

That's how it's being spun now, and perhaps in the email that went out today that I have not been privy to (probably because I voiced my disagreement with the idea at the time).

That's not how it was being discussed at the time.

jacquesm14• 16 years ago

Anybody that wants to check up on that, here is the chat log:

http://www.freechromelaptop.com/irc.txt

This was in open channel on #startups, I've redacted the names of the other participants.

tptacek3• 16 years ago

From the email he sent out, it was pretty clear that he hoped to do this in good faith. Nevertheless, blunting this stunt with a post was the right thing to do. Everyone should just drop it now.

x0ner• 16 years ago

I can't say I see anything wrong with the crude learning lesson he was trying to put out there. I myself wrote a quick Wachovia Chrome Extension that never stored credentials, but tracked if someone actually put them in. Upon a "login" the user would be presented with a warning about the dangers of phishing and how to be safe. It blew my mind to see people actually writing comments telling me they tried to log in multiple times, but never had success. Sometimes learning the hard way is the only way.

https://chrome.google.com/extensions/detail/pcgpfcjfajapilli...

GHFigs• 16 years ago

I don't want to be a part of a community where supposedly respectable members might try to phish me if they don't like my attitude.

The particulars in this situation only keep me from being angry. Was it malicious or harmful? No. But is it irritating to know that crap like this going on and that I might be punished for not lurking the right IRC channels? Hell yeah. I don't need that kind of attention-theft in my life.

Plead HN: Please be careful with your information

Related Stories