Hacker News Reader

Comment by hemancuso | Hacker News Reader

This was particularly effective because the app was registered as "Google Docs" - to not even filter names of your own products out seems ripe picking for imposter apps.

View on HN

Nah... they can just say "Free unsubscribe service" or "Free <whatever>". And people will click like crazy. And you can make actually make VC fundable business using that technique.

Was it actually called "Google Docs", or was it a homograph?

https://en.wikipedia.org/wiki/IDN_homograph_attack

I've seen this point and agree with it, but I really have to wonder: if the app was just called "Documents" or "My Docs" and had a professional-looking icon, would a significant number of people really have given it a second look anyway?

It was "Google Docs"

I understand that - my question is whether the name is actually a factor that contributed to the spread. As AfroThundr said above, people just want to get to their content and want the dialog to go away. A known contact sends you a document - you're going to trust that and want to see the document. Unless it said the app name was "I'm going to hack your bank account" they'll probably click it (and even then, some would go for it anyway.)

The message was "Google Docs would like to 'Read, send, delete, and mange your email'".

People are way more likely to accept that than if the dialog had been "hhhhhhhhhhh@mailinator.com would like to 'Read, send, delete, and mange your email'".

Trends are moving away from displaying full URLs as well, and while it may look cleaner, I never asked for information to be hidden from me.

I'm fairly certain a large number of users would still click allow without a second glance, much like hitting "allow macros" in an office document. They just want the annoying dialog to go away.

Reply on news.ycombinator.com