Chaotic lawful 😂
Just read this to a beautiful woman I know.
Her response: That’s not going to end near as well/funny as you think/hope it will.
I like to think I’d find this hilarious if done to me. I found it funny enough to save and send to my friends. On the other hand, I’m reading it as a joke now online, not actually going through it, and I can see how if it had been done to me I might be upset. Not sure if I would have been or not!
(Am woman in a hetero relationship.)
Beautiful (hetro) woman I talk to says: She would find it funny (her husband is a big joker), but yes, it could be stressful at the onset to be told your husband is cheating on you.
Blink 8 times if you’re in danger
Blink 182 times if it’s just all the small things
If not in danger, just take off your pants and jacket.
And your boots and your sunglasses…geev dem toa meeh.
— Arnold Schwarzenegger as The Terminator
Den get to da choppah
Neither is your future if your wife maintains such easily exploited vulnerabilities.
His wife is not Italian. If she was he would not even dare to do anything of the sort.
Is his wife Yor from Spy x Family? While good choice, she’s fictional, so you’re up to the greatest cuckoldry ever witnessed in human history: waifuism.
All these people setting up filters don’t understand it is supposed to train you in case a real phishing attempt is made.
Those filters aren’t going to stop real ones.
But if you want to blow up the database server you need to work on because you couldn’t be bothered to click a button when a phishing test comes around, then you better quit your job in tech.
I swear, developers are some of the biggest security concerns in any company. They complain the moment some access is blocked for good reason. Much bigger concern than old nancy “never-had-a-computer-at-home” clicks-a-lot.
If the fake phishing emails can be caught by my very rudimentary filter they weren’t particularly good anyway. Besides, I still have to look at those emails and report them, otherwise my IT still counts it as a strike against me. Win-win. IT continues to keep me on my toes and I don’t have to take another 30min training course because I ignored an email for a day or two.
So what about links on social media, say you beefed with the tankies, then one on an alt account sends you a link to an article, could be phishing no? What to do then?
Take a while to open it. If they Ping you and keep asking “Why haven’t you clicked the link yet?!” You’ll know they were Putin a trap in your DMs, and you got them by Stalin. That Marx them as a phisher.
😎<br> 👉👉
Your comment is pure art
Full Marx
Mao.
Incredibly kind words, thank you. I’m glad you enjoyed it! :D
This kills the trust
Yeah, the wife didn’t trust the husband and clicked the link. Shameful, tbh
Just don’t read the mails and you won’t get fished
I failed one of those because I have script blockers on my browser and I wanted to see what the scam was.
Same, script blocker, virtual machine, etc. Found that apparently you are not meant to forward/report the scam to IT either.
Moral of story: Never inform the company of any suspicious behavior; just ignore it.
There’s a button that says report phishing for many companies
some phishing emails also have a button like that, very funny
Keyword here being “many companies”.
The URL is likely unique to identify you as soon as you have clicked.
Yeah, that’s why I had to take the online safety course again.
It wouldn’t have been able to do much to my computer though, if it really was a suspicious site.
I got to take security training for that once, too.
It was worth it.
Simply write a script to cycle through thousands of URLs. The whole company will get identified and then nobody has to retake the training.
I suspect that there are more than a few thousands URLs to if you want to go down that route.
I gotta do this.
There’s usually nothing wrong with just clicking a link (if your browser is set up correctly). The problem begins if you actually enter any sort of information in a random website or something.
This is extremely bad advice and is akin to saying there is nothing wrong with shooting someone in the chest as long as they’re wearing a bulletproof vest.
Sketchy websites should be avoided. Even experts don’t think of everything possible to attack.
It’s the same reason you shouldn’t expose your pc directly to the internet even if you have a secure os installed.
…Bonus points for you in another thread today doubting that it’s possible to lock one’s keys in a car.
Be extra careful if you’re logged in on any other site in another tab though. Or even if you closed the tab.
Can you elaborate on this?
from what i’ve heard, even if something isn’t able to break out of your browser, it may be able to gain access to cookies. those cookies in turn can carry a lot of info and even unlock some accounts. iirc that’s how the linux tech tips channel got into trouble.
everyone, please correct me where i’m wrong. thank you.
Does that make it dangerous to log in persistently anywhere, period, in case you click on a shady link? I legitimately don’t know much and trust common sense prevention (run sites through virus total if I’m not familiar with them) and built in protection to do most of it, and I haven’t had any known password thefts from anything other than servers getting hacked. I do have an authenticator app and use it on really important stuff (government, school) but that’s about it.
well, i’ve been taught that keeping cookies around is somewhat dangerous, and that because of that browsers like librewolf always clear your cookies. i’m by no means an expert tho, so you might wanna read the other commenters input on that.
Cookies are specifically separated out per-domain. Your browser will not give a random website access to your auth cookies/localstorage for other websites. There are some awful companies which do set cross-website cookies (e.g. facebook, google, and other adware), but (1) those cookies are not auth credentials and are used mostly for fingerprinting and ad targeting, (2) should be filtered out by your browser’s tracking protection (hence “if your browser is set up correctly”).
Realistically there is still be a way for the website to fingerprint you enough to know who you are even without cookies, so the most adversarial outcome from clicking a link is that the attacker can know that you clicked that link, along with your general location (from geoIP) and some device info.
iirc that’s how the linux tech tips channel got into trouble.
Nah, that was pretty much an .exe sent out by a fake sponsor, which then stole all browser data (including google auth cookies). Opening a link ≠ running an unsandboxed exe.
all i can say is that i need to log into outlook to log into teams, because logging into teams directly is broken, but the cross site cookie work…
and reading stuff like adFection really doesn’t instill confidence in opening random websites.
but most probably you’re right for most cases.
This works because loggin in to outlook sets a cookie for login.microsoftonline.com which is reused by other Microsoft products. Each product requests a token from login.microsoftonline.com and as long as you have a valid cookie for that domain it will return a token that the app (outlook/teams/onedrive/etc) can use to access its own api.
The cookie itself stays bound to login.microsoftonline.com and it’s never shared with other domains and the service at login.microsoftonline.com will not provide tokens to requests from non-microsoft domains.
all i can say is that i need to log into outlook to log into teams, because logging into teams directly is broken, but the cross site cookie work…
Thankfully I don’t even have an MS account, but I do implore you to check out the cookies and see for yourself that they will have a specific list of domains they are valid for.
Open the browser developer menu on an Outlook tab (F12), navigate to “Storage” → “Cookies” (may be named slightly differently in different browsers), and look at the “Domain” column in the table.
and reading stuff like adFection really doesn’t instill confidence in opening random websites.
The problem there is website operators selling their adspace to a literal israeli spyware company, which meant injecting adversarial javascript into their own pages. It was not a case of “user opening a random link”, rather it was the website operator themselves forwarding the user malicious JS from the “ad company”. As a user there’s generally nothing you can do to prevent this kind of attack where the website itself was compromised; besides, without another vulnerability/attack vector the impact will be limited to the website in question.
No, you generally should not be worried about that.
Generally the worst thing that a website can get from you just opening a URL is (1) whether or not you’re logged in to google/facebook/etc, (2) your advertisement profile/who you are, (3) roughly where you are. All those are privacy issues, not a security issue, hence not very related to the “cybersecurity course”, and only the first one is tangentially related to being logged in.
You should of course use various anti-tracking measures, e.g. an adblocker, “resist fingerprinting” in Librewolf, user agent faker, a good VPN, etc. That will reduce the exposure to all 3 issues above, but once again those are not security problems.
You should also never download random bullshit to your computer. Having an actual file on disk outside the browser sandbox could indeed be an issue. You could simply forget where it came from and decide to execute it one day, or there could be some bug in some app on your OS which could trigger a code execution exploit.
However, if your browser shares authentication details with random websites like what you are describing, you should stop using it immediately.
The thing is, a link in an email is not any different than a link here on Lemmy, yet we click on those all day. Yes, both could lead to a malicious website, and if you don’t have a recent web browser, then you could get in to trouble without any action.
IMO, the only reason why there is a focus on phishing simulation in orgs is because email is something IT owns and you can easily track who does and doesn’t open an email. If there is a legitimate concern with opening random links, then phishing simulations would also extend to maybe peppering fake links on LinkedIn or other places where IT thinks their co-workers are browsing, but no one (AFAIK) does this.
My work email is a .edu, and so most of ours are just social media phishing attempts with fake IG and Tiktok links. But why I’m the world would you use .edu for those?
You wanna target .edu, do a quick check on our publicly accessible faculty pages and pretend to be us. I swear, we’ve got like zero protection against that, lol.
Hey Barb, I forgot my keys, please leave the garage open. Thanks, Jeff.
Boom, stole the faculty coffee maker.
You can probably fence that for more than the $300,000 spectrometer.
You are my world, even if voice to text used to work before AI, but fucks up the simplest shit now.
Note that at no point does he claim this “proof” is falsified.
Sounds kinda like the Tale of Foolish Curiosity from Don Quixote. Spoiler: the wife was a good woman and wouldn’t have cheated on the guy… until he started being an asshole by subjecting her to endless tests to prove her virtue.
I’ve been meaning to read Don Quixote and this is the tipping point. I want to make quixotic references.
My knee jerk reaction is to calmly explain why this isn’t appropriate in a corporate environment.
I’m so broken.
