Danger - Phishing ahead > Simplest Solution

Simplest Solution

My email client linkifies appropriate plain text, but will not hide the link. Anyone using HTML to read email is nuts.

However - sure, you would have to 'view source' of email, web pages, pop-ups, bulletin boards? And what about redirections where you cannot catch where you were bounced around to?

the only thing that is on the side of the users here is that phish sites have mostly looked pretty lame. Spelling errors, graphic mistakes, etc. But it took me about 30 minutes to duplicate symantec as the demo. Give me a week and I could do the a most convincing job of reproducing the home page and login pages of a bunch of sites, then inject these fake URLs into the community and collect passwords.

You could even ask for someones login name and password once, then redirect the browser to the real page. They user thinks they made a mistake, and types it in again. Oldest trick in the book.

said by justin:

---

You could even ask for someones login name and password once, then redirect the browser to the real page. They user thinks they made a mistake, and types it in again.

---

reply to pleekmo

said by pleekmo:

---

Doesn't anybody [View Source] of their e-mails to make sure that a link is valid?

This would seem to be a very good way of determining if the link you are clicking on is to a valid site rather than a spoofed one. (Ditto for web sites, I suppose.)

---