Plead HN: Please be careful with your information

So, time to own up then, it seems the cat is firmly out of the bag, apparently icey thinks the chances of success are better than I do ;)

The evil part in me could not help but wonder about how everybody seems to be so psyched about receiving a chrome notebook that they throw caution to the wind and enter anything and everything in to a form on some server somewhere allowing the google marketing department to significantly update their profiles with all that data they supply, and all that for the chance of getting a laptop.

This sort of action is a very common marketing tactic, but I was actually quite surprised to see how popular it was on HN. Also, the fact that google was happy to collect your information even when you can't receive the notebook was an interesting detail, and lots of people only realized that after filling out the form.

Then the other day a second thing happened, someone solved the contest that was embedded in the video that was used for the launch of the product.

The evil part of me again thought wow, what a large amount of work that was done here, I wonder how people would respond to a second contest, with a much larger number of notebooks to be won?

So, within a few minutes a plan was hatched, a simple idea to see how susceptible a security conscious community is to stuff like this. The domain is plainly in my name and just about all the tell tale signs of a phishing scam are present. Over the course of the last couple of days the text was polished to make it more clear what the intent is.

The url of the site is http://www.freechromelaptop.com/ , the url of the payoff page is http://www.freechromelaptop.com/process.html

Since I'm the main 'driver' behind this little prank I take full responsibility for it and for the fall-out if any, the other co-conspirators would have never done this without me asking for it.

I hope you'll forgive me for having a devious side to me, but I intended for nothing but good to come out of this, and I hope that even if the project never got underway that you will take these words to heart, please be very careful with what you fill out in online forms, even if the page looks genuine and it is google that is giving you a chance to win some laptop you have to wonder if the collective value of the information given up does not exceed greatly the value of the goods they are shipping.

  Jacques

This has been done already on HN.. s/freechromelaptop/wakemate/g

"I hope you'll forgive me for having a devious side to me, but I intended for nothing but good to come out of this ..."

People don't like being duped, even if it's for their own good. You're likely to get more "f--k you's" than "thank you's".

If you want to teach someone a lesson, you don't start out by telling them they are stupid.

To create some real, lasting value you could have created the app and then said something like, "Hey everybody! I made this fake marketing web app that will steal your information and show you how it's done step-by-step. If you want to see how web scams are done, follow this link: ..." Then make some fake Google accounts for people to use (instead of their own).

"... you have to wonder if the collective value of the information given up does not exceed greatly the value of the goods they are shipping."

+1 for that sentiment. If your info wasn't more valuable, they wouldn't be doing it.

If you want to teach someone a lesson, you don't start out by telling them they are stupid.

I think it depends on the person. Let's consider two scenarios.

1. "Never fill in your details on suspicious sites."

2. "You recently filled in your details on xyz.com. Now I know that your credit card number is 1234."

In response to (1) I would nod, but would it register deep enough? Not so sure. Now if someone actually shows me that he duped me into giving out sensitive details, I would be way more impressed and remember the lesson for longer.

I agree some HN users are overconfident, and education and even demonstration can be valuable. But, your experiment is quite literally a crime in many jurisdictions: obtaining identity information using false pretenses. You could be fined or jailed for such an educational 'prank'.

If i were to save the info in a useable form, then yes, but identifying information (names and email) was only saved as a hash, not as plaintext.

That of course makes it impossible to see if people enter fake information or not but I'd hate to give a bad guy the opportunity to hack the server and walk out with the info.

Oooooh - well done! I love the "How many Google Chrome laptops do you want?" question :D

How many entrants did you get?

I imagine he got zero, since icey posted this post before he got it running.

The really surprising thing here is that so far three people have actually filled out the form.

Results?

Well done!

Shout next time you're in London and I'll buy you a beer! :)

I avoid phishing with some basic rules:

1. Never give passwords to a third party (so, for example, no Mint).

2. Never give anything more than an email address to someone you wouldn't also give your credit card number to. I only give an address or phone number when I'm planning on buying something.

3. Never log in after following a link. Always log in by manually (either through typing the URL or a bookmark) visiting the site.

Excellent rules and I really think those ought to be pasted to the front of every monitor of everybody that ever fell for a phishing scam, and preferably to the front of the monitors of those that have not yet fallen victim to one too.

I was wondering about the no use of Mint. This post (by mint itself) says that they don't store passwords and only provide a read version of your data. http://satisfaction.mint.com/mint/topics/is_my_data_safe_wit...

Could you/someone who has more knowledge of this than me explain how this is safer (if it is) and then possibly explain if/how someone could hack mint to get my information.

I always thought of mint as just as safe as using online banking, is this very flawed?

Mint stores you passwords. As with anything you are increasing risk by adding a third party to the equation.

Not sure how this works, but the way they describe it they say that they don't really store them, but your internet finance provider stores them and they only access via some credentialing. It does make sense that just adding someone to the equation adds more possibilities for risk

Can you explain (3)? Isn't it enough to check whether you're on the right domain before logging in? Or is this to prevent logging in at an IDN URL that looks like the real URL?

Domain check is good, but can be misread, especially with IDNs. Of course, URLs can be mistyped too and a lot of phishing is based on typos of URLs. So really, in the end, you should always follow a bookmark before logging in.

I trust my password manager. It auto-fills my passwords only on correct domains. When my password manager doesn't work, I'm highly suspicious.

Plus I use passwords that are auto-generated based on domain name, which I copy & paste to the generator. Hopefully this makes me immune to homograph attacks.

What pm do you use?

1Password Password Manager and Form Filler may be an option: http://www.apple.com/downloads/macosx/networking_security/1p...

Opera's built-in “Wand” + my own script. I like that Opera highlights recognized fields, but doesn't fill them in until I tell it to.

1Password takes care of that for me. I don't see any accounts available if I'm on the wrong domain name.

There's various reasons that #3 is particularly useful, though I think the original writer was probably more concerned with links in e-mail or links on sites other than the site you're being asked to log in to (such as links from advertisements or other third-party sites):

1) Similarities in the way letters look in certain fonts can cause you to think you're on the correct site when you are not. This is mitigated by EV SSL usually, but if you're not paying close attention you might miss it.

2) Browser exploits (though I'm unaware of any specific ones in current browsers) have commonly focused on tricking the browser into displaying one URL when the page is actually being hosted by another.

3) Links in e-mail, specifically, asking you to "login and update your information" (or "login and sign up for paperless billing now!" is pretty common, especially when combined with some perk). Often these links use redirection to gauge effectiveness of the e-mail campaign, so it's common for the link to look strange. If the e-mail is a phishing attack, that redirection could include code injection resulting in you being sent to the right URL to login, but with malicious code inserted to capture credentials or do other fun and exciting things. Of course, the site would have to have some existing XSS vulnerability on the login page, or the code would have to be attacking a browser/plug-in vulnerability, for you to see the EV SSL indicator properly in the address bar.

The last point is also usually mitigated by extensions like NoScript in Firefox.

I fell for this trick with twitter-alike url. 2 things did it for me. The link was from a friend of mine (of course he didn't know that was phishing site). And, it was a replica of Twitter. To make things worse it was shortened using bit.ly. I realized I made a mistake only after I entered password and hit submit. I quickly logged into twitter and changed my password.

It has already happened on reddit last week. Someone came to /r/favors and offered a free premium account to a file hosting website he had just built. The deal was: you open an account on the website, you PM'me your username and I'll make it premium. Of course he got a load of users giving him data and then disappeared, along with the website.

Any other "HN Rate my webapp" thread could do the same.

There are ways of hashing nice password with custom-modified algorithms and bookmarklets. Use them guys.

So, wait a minute... jacquesm contacted you with an idea for a relatively harmless experiment (I was contacted too, so I know what it was about), and your response was to post it all on HN without even talking to him first?

It seems that icey did not think it was so harmless and wanted to inform the community in case any malice was involved. If this experiment was completely harmless I don't see why the contributor needed to contact so many people (as it seems they contacted quite a few active members from the comments) in order to perform it.

Knowing what the phishing in question was, yes, it was pretty harmless. Even if it was not, jacquesm would not risk his reputation in doing something malicious to the HN community, so this is a case where a private email might have done the same as this public notice.

I'm not saying anyone here did anything terrible, but usually when contacted privately you first respond privately, so this is a bit out of order. It's not like jacquesm wouldn't have listened to arguments about this, and so an immediate action in the form of this post is, well, just bad form.

Edit: jacquesm has come forth with it, so I've replaced "a contributor" with his username.

> Even if it was not, jacquesm would not risk his reputation in doing something malicious to the HN community,

Not intending to get into this specific debate, but that's precisely the wrong way to think. Well respected individuals with a good reputation risk their's every day. More importantly, for many, jacquesm is a faceless individual. How can you be certain he's the one who concocted this plan and it wasn't someone who fished out his information in order to utilize his reputation to gain something? Especially when this so-called "jacquesm" is trying to phish out information from the HN community, something that could hurt his reputation regardless of the intent.

I'm not suggesting he wasn't who he said he was, nor should be distrust him. Rather, we need to always be aware of what we trust (and an email from a friend is merely that, an email, not your friend).

> and an email from a friend is merely that, an email, not your friend

Excellent point, and one that can't be stressed enough.

I did respond in channel; I'm not sure what your problem is with that.

Or, the reverse, exactly because it is known to quite a few members, if there were any malice in it that would have never happened. And then icey would not have been able to spill the beans.

No, he did not contact me about it at all. It was being discussed in irc. I told him I thought it was a terrible idea there, but since it was still being pursued, I posted here.

Being contacted on IRC is still being contacted.

He was discussing it in channel. How is that different than a publicly held conversation? I only happened to catch it because I switched into my client for a minute while doing a deployment. This was not a private conversation.

Isn't this a better conversation for email?

I assume his idea is "hey hackernews do you like my startup please sign up to try it out" and then (edit: after signing up) the login page will have a "server error" when you try to view the idea and that way he doesn't have to build a product and won't attract suspicion. "oh sorry you hammered my server, it'll be back later today".

No, it's dumber than that.

Wouldn't this be mitigated by not using the same login information on the startup site?

Icey, I'm presuming you knew that the point of the plan was to educate and remind us all that we're not immune from this kind of thing. So it's quite clear jacquesm had no malice here, if he did do you think he'd discuss it so openly? Since you've come out and spoiled this quite valuable opportunity, do you believe your post is in any way more effective at communicating the message than submitting the fake phishing site would have been?

That's how it's being spun now, and perhaps in the email that went out today that I have not been privy to (probably because I voiced my disagreement with the idea at the time).

That's not how it was being discussed at the time.

From the email he sent out, it was pretty clear that he hoped to do this in good faith. Nevertheless, blunting this stunt with a post was the right thing to do. Everyone should just drop it now.

Anybody that wants to check up on that, here is the chat log:

http://www.freechromelaptop.com/irc.txt

This was in open channel on #startups, I've redacted the names of the other participants.

This is missing parts of the conversation; but seriously Jacques, I've got no appetite for making this about you.

We both agree that it's easy to phish people. I disagreed then and still disagree now that the right way to do that is to embarrass them.

If I wanted to "shame" you somehow, I could have easily done that by naming names to begin with. The only intention of this submission was to warn people that you must be careful with your information because you never know who might be out to get it.

I don't believe you were out to snag people's financial data, but beyond that it was pretty tough to tell what you were after other than "teaching other people a lesson" (yes, this is paraphrased).

I fail to see what positive outcome could occur from essentially pointing and laughing at people because they fell for your scheme.

[Edit: I did a bad and edited this comment. Originally it only said "This is missing parts of the conversation", which is what jacquesm is replying to.]

It absolutely is not, that's a 1:1 log of my stuff and no parts were removed other than the lines not spoken by me or referring to me.

I don't think posting a full log of the channel is appropriate, if the other people that were there wish to publish their parts with their ids in there that's fine with me.

Okay, then why are people responding to me at the bottom of the log when I haven't said anything in it?

Because my name does not appear in those lines, so grep does not show them. Again, I'm not going to post other peoples words without their permission.

Okay, but just so we're clear: This is missing parts of the conversation.

working on getting permission to post an unredacted log. But you'd be hard pressed to distill malice out of my words, 'just so we're clear'.

I would be happy to have whatever conversation you'd like over email. There's not much point in bickering like this here.

I did not post the article above, and I did not use the words 'that's how it is being spun now', those were yours and they are what prompted this, you chose the forum.

The email you refer to which explained the whole thing in some detail was sent to the one person whose reputation might have been harmed but if I had not I would not have been able to tell if he had fallen for it or not (highly unlikely anyway) because identifying information is hashed to make sure that even I can't accidentally leak who fell for it.

My email is in my profile, feel free.

I don't think you need permission to post something that a person has said on IRC. In fact, I know you don't.

It's not a matter of need, it's a matter of courtesy, seeing as I've been called out for exactly that on HN before.

I can't say I see anything wrong with the crude learning lesson he was trying to put out there. I myself wrote a quick Wachovia Chrome Extension that never stored credentials, but tracked if someone actually put them in. Upon a "login" the user would be presented with a warning about the dangers of phishing and how to be safe. It blew my mind to see people actually writing comments telling me they tried to log in multiple times, but never had success. Sometimes learning the hard way is the only way.

https://chrome.google.com/extensions/detail/pcgpfcjfajapilli...

Good idea, as long as it is only to demonstrate proof of concept (or in this case, opinion). Better be pointed to your own failures like this than wait for someone with more malicious intentions :)

Sounds like this guy has way too much time on his hands. And what did you mean by "his theory"?

i think his theory is that HNers and redditors have a more elitist attitude about themselves and their tech skills, but will fall for the same basic traps as their grandma. (or, thats what it sounds like to me)

Sounds like a reasonable theory. All it takes is a moment of carelessness or not being up to date to the latest exploit.

That said, we do step into fewer digital traps than a less technical person.

agreed, and i think that we'd be more likely to fall to a specially tailored trap than a generic bank account email type of thing. as would anyone.

This community on average is more technical than most but that is just aggregate statistics. I would say that in any community you are going to get x% that would fall for a phishing scam.

oh, i mean, i agree. in school, i did a project in a network security class that involved phishing the network security class, and it had a roughly 50% success rate.

if someone were to seriously try and phish any specific site, they'd probably be reasonably successful. the question really is, how long would it take for someone to recognize what was going on and get it killed? will 20 people visit the page, or will 2000?

That was one of the questions we hoped to answer.

It pleases me to say that in spite of it being an obvious 'fake' it didn't take mozilla more than a few hours to have the site marked as a phishing site, which I think is really great for them.

To be honest, I'd rather have you, Jacques, be the recipient of my personal information than some random guy with the clear intent of selling that information. I don't even know you!

At the same time, I'm a pretty skeptical guy, and any domain name of www.freeproductx.com screams of fake and phony to me. Anyone that submits their information there, especially from the more technically savvy HN crowd, needs to take a look at what they are trying to accomplish. I do have to give you credit, the site does look amazingly legit, though Google does tend to use minimalistic themes so the time taken shouldn't be too involved. And because I am skeptical, the nameservers aren't all that convincing: NS1.MATTHEIJ.COM :)

There were more than enough hints that this was a prank that even a cursory inspection would show the truth, and that was a conscious decision.

It would have been fairly easy to make it a lot more resilient against that but we figured that by making it this plain those that fell for it would know that they had failed to do due diligence before entering all that data.

A simple whois would have been enough, as would have been a google search for 'second chrome notebook contest' or anything else like it. Google consistently refers to the device as a 'notebook', the site used 'laptop' in the domain but notebook elsewhere, the site was not hosted on a google IP range and so on.

We already got a warning before (I assume) it happened, so I'm guessing it wouldn't take too long before we find out if something like that would occur. Or it might not even reach front page.

Is the solution to all this not Facebook Connect and Google Login?

No, indeed it is not. If the problem is that people are getting phished because they type their info into a spoofed login page, how would making one standard login page be the answer?

Well, I for one don't want all of my accounts linked together. I don't think that's information that Facebook or Google needs.

Definitely! Lump all my logins into a single point of failure, so that if something is compromized, everything is!!! Awesome idea. :/

It's also a single point to defend.

I don't think that it would be possible for me to fall for a HN phishing attack seeing as how I don't even have a password with HN. I logged in over a year ago using one click authentication linked to my Google account. The only way I could theoretically be effected by a phishing attack would be if the attacker somehow logged me out, then made a page which tricked me into thinking that I was clicking on HN's one click login.

I don't want to be a part of a community where supposedly respectable members might try to phish me if they don't like my attitude.

The particulars in this situation only keep me from being angry. Was it malicious or harmful? No. But is it irritating to know that crap like this going on and that I might be punished for not lurking the right IRC channels? Hell yeah. I don't need that kind of attention-theft in my life.

To avoid giving out too much information about myself on the web, I try to follow these rules: 1. Never give my actual name or address unless I'm intending to buy something. 2. Unless the website looks fairly reputable, I register with wh4f.org throw-away email account. 3. Third parties have no need to know any of my passwords. 4. Nigerian prime ministers don't contact random people on the internet.

Has 4chan got the black eye for HN/reddit?