<div><div dir="auto">Another point I missed - one could try verify the owner of the url from the Whois if they were aware of Whois in the first place. But it seems likely that the replacement to Whois data underway with the EPDP discussions (triggered by the GDPR) will create barriers to see who owns a domain.</div></div><div dir="auto"><br></div><div dir="auto">Dev Anand </div><div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Sat, 8 Feb 2020 at 7:33 AM, Dev Anand Teelucksingh <<a href="mailto:devtee@gmail.com">devtee@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div dir="auto">Well most persons would </div><div dir="auto">- click on links, </div><div dir="auto">- see visually the site looks like the site they are used to, </div><div dir="auto">- may see a padlock so they think it’s safe ; - may see from the url bar if the domain is the one they are accustomed to ;</div><div dir="auto">- see the name of the company/service they are going to as part of the long URL and assume it’s legit.</div></div><div dir="auto"><br></div><div dir="auto">- consider how long URLs to documents or files are delivered <a href="https://community.icann.org/display/atlarge/2020-01-27+At-Large+Technology+Task+Force+Call?preview=/126420432/126422910/atlarge-technology-taskforce-27jan20-en.pdf" target="_blank">https://community.icann.org/display/atlarge/2020-01-27+At-Large+Technology+Task+Force+Call?preview=/126420432/126422910/atlarge-technology-taskforce-27jan20-en.pdf</a></div><div dir="auto"><br></div><div dir="auto">A bad person could create a link like</div><div dir="auto"><div><a href="https://community.icann.org.can.work/display/atlarge/2020-01-27+At-Large+Technology+Task+Force+Call?preview=/126420432/126422910/atlarge-technology-taskforce-27jan20-en.pdf" target="_blank">https://community.icann.org.can.work/display/atlarge/2020-01-27+At-Large+Technology+Task+Force+Call?preview=/126420432/126422910/atlarge-technology-taskforce-27jan20-en.pdf</a></div><div dir="auto"><br></div><div dir="auto">and I dare say most would find it hard to figure out whether it’s legit or not. And if the link to the file is a malware file that opens and executed on clicking, then it’s too late.</div></div><div dir="auto"><div dir="auto"><br></div><div dir="auto">Dev Anand <br></div></div><div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Fri, 7 Feb 2020 at 3:59 PM, Johan Helsingius <<a href="mailto:julf@julf.com" target="_blank">julf@julf.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">The fact is that people click on links and do searches, they don't type<br>
in domain addresses.<br>
<br>
Anyway, how do you know "<a href="http://mybankinfo.com" rel="noreferrer" target="_blank">mybankinfo.com</a>" is a safe site in the first<br>
place? And if someone can steal credentials or place malware, looking at<br>
the URL won't help.<br>
<br>
Julf<br>
<br>
On 07-02-2020 20:52, Dev Anand Teelucksingh wrote:<br>
> A large problem is when bad persons obscure the domains of companies in<br>
> phishing campaigns so that persons go to the bad persons' website on<br>
> another domain and steal their credentials or get malware installed.<br>
> <br>
> So say you get an email link from a trusted person whose been hacked<br>
> saying - "hey we're not sure your paycheck was delivered to mybankinfo.<br>
> Can you login to <a href="http://mybankinfo.com.paymentlogin.info" rel="noreferrer" target="_blank">mybankinfo.com.paymentlogin.info</a><br>
> <<a href="http://mybankinfo.com.paymentlogin.info" rel="noreferrer" target="_blank">http://mybankinfo.com.paymentlogin.info</a>> and check?<br>
> The challenge is that persons may just see "<a href="http://mybankinfo.com" rel="noreferrer" target="_blank">mybankinfo.com</a><br>
> <<a href="http://mybankinfo.com" rel="noreferrer" target="_blank">http://mybankinfo.com</a>>" and assume they are going to the <a href="http://mybankinfo.com" rel="noreferrer" target="_blank">mybankinfo.com</a><br>
> <<a href="http://mybankinfo.com" rel="noreferrer" target="_blank">http://mybankinfo.com</a>> site.<br>
> And because they clicked on the link, how would the browser "know" what<br>
> the site you really intended to go to?<br>
> <br>
> Dev Anand<br>
> <br>
> On Fri, Feb 7, 2020 at 3:04 PM Johan Helsingius <<a href="mailto:julf@julf.com" target="_blank">julf@julf.com</a><br>
> <mailto:<a href="mailto:julf@julf.com" target="_blank">julf@julf.com</a>>> wrote:<br>
> <br>
> On 07-02-2020 19:49, Dev Anand Teelucksingh wrote:<br>
> > Hmm....How would persons know what is the website they are viewing on<br>
> > without the URL?<br>
> <br>
> How many users check out the website info in URLs anyway? How will they<br>
> know that Mybankinfo.com is OK, but <a href="http://mybank.info" rel="noreferrer" target="_blank">mybank.info</a> <<a href="http://mybank.info" rel="noreferrer" target="_blank">http://mybank.info</a>><br>
> isn't?<br>
> <br>
> Shouldn't it be the job of the browser to check if the web site is the<br>
> one you want to talk to (based on certificates)?<br>
> <br>
> Julf<br>
> <br>
> _______________________________________________<br>
> ttf mailing list<br>
> <a href="mailto:ttf@atlarge-lists.icann.org" target="_blank">ttf@atlarge-lists.icann.org</a> <mailto:<a href="mailto:ttf@atlarge-lists.icann.org" target="_blank">ttf@atlarge-lists.icann.org</a>><br>
> <a href="https://mm.icann.org/mailman/listinfo/ttf" rel="noreferrer" target="_blank">https://mm.icann.org/mailman/listinfo/ttf</a><br>
> <br>
> _______________________________________________<br>
> By submitting your personal data, you consent to the processing of<br>
> your personal data for purposes of subscribing to this mailing list<br>
> accordance with the ICANN Privacy Policy<br>
> (<a href="https://www.icann.org/privacy/policy" rel="noreferrer" target="_blank">https://www.icann.org/privacy/policy</a>) and the website Terms of<br>
> Service (<a href="https://www.icann.org/privacy/tos" rel="noreferrer" target="_blank">https://www.icann.org/privacy/tos</a>). You can visit the<br>
> Mailman link above to change your membership status or<br>
> configuration, including unsubscribing, setting digest-style<br>
> delivery or disabling delivery altogether (e.g., for a vacation),<br>
> and so on.<br>
> <br>
> <br>
> _______________________________________________<br>
> ttf mailing list<br>
> <a href="mailto:ttf@atlarge-lists.icann.org" target="_blank">ttf@atlarge-lists.icann.org</a><br>
> <a href="https://mm.icann.org/mailman/listinfo/ttf" rel="noreferrer" target="_blank">https://mm.icann.org/mailman/listinfo/ttf</a><br>
> <br>
> _______________________________________________<br>
> By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (<a href="https://www.icann.org/privacy/policy" rel="noreferrer" target="_blank">https://www.icann.org/privacy/policy</a>) and the website Terms of Service (<a href="https://www.icann.org/privacy/tos" rel="noreferrer" target="_blank">https://www.icann.org/privacy/tos</a>). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.<br>
> <br>
<br>
_______________________________________________<br>
ttf mailing list<br>
<a href="mailto:ttf@atlarge-lists.icann.org" target="_blank">ttf@atlarge-lists.icann.org</a><br>
<a href="https://mm.icann.org/mailman/listinfo/ttf" rel="noreferrer" target="_blank">https://mm.icann.org/mailman/listinfo/ttf</a><br>
<br>
_______________________________________________<br>
By submitting your personal data, you consent to the processing of your personal data for purposes of subscribing to this mailing list accordance with the ICANN Privacy Policy (<a href="https://www.icann.org/privacy/policy" rel="noreferrer" target="_blank">https://www.icann.org/privacy/policy</a>) and the website Terms of Service (<a href="https://www.icann.org/privacy/tos" rel="noreferrer" target="_blank">https://www.icann.org/privacy/tos</a>). You can visit the Mailman link above to change your membership status or configuration, including unsubscribing, setting digest-style delivery or disabling delivery altogether (e.g., for a vacation), and so on.</blockquote></div></div>
</blockquote></div></div>