Hacker News Reader

Comment by cm2187 | Hacker News Reader

I recently received an email claiming to be from paypal (the SPF+DKIM passed) but inviting me to click on links in "epl.paypal-communication.com". How do I know this is not phishing? It certainly looks like phishing, and I certainly wouldn't click on those. But if it is not, how stupid must these guys be to use "paypal-communication.com"?

View on HN

How do you fake DKIM though? That is as good as a TLS certificate.

I suppose someone might've taken over your browser or email client, but then it is game over anyway.

Perhaps PayPal should start MIME signing whole messages...

Which is why I think it was rather a moronic choice of domain on the part of paypal. But I know how to look for spf/dkim validation. A normal user (or a user using a mobile/tablet) will make a decision purely on the domain of a link.

Whois says it's owned by Paypal on MarkMonitor, but that can be faked, right? Or does MarkMonitor require email address validation? (hostmaster@paypal.com in this case)

Correct. But even if the whois wasn't fakeable, do I really need to run a whois before I click on a link in an email?

Almost like we need an ssl-like authority for email now. Ugh.

MarkMonitor specifically is pretty picky about only taking on large-scale corporations (google.com, amazon.com, microsoft.com to name a few) so just the fact that it's registered there is usually a reliable way to confirm legitimacy, but checking whois is still way more research than an average PayPal user should need to do to avoid being phished.

you forward it to spoof@paypal.com, and then get a response pretty quickly telling you whether it was phishing or a real email.

Sadly, I don't think so: https://cantoriscomputing.wordpress.com/2017/03/04/paypals-e...

Reply on news.ycombinator.com