Hacker News Reader

Comment by _8j50 | Hacker News Reader

Paypal-communications.com is a lookalike phishing domain, true or false?

I don't think these companies understand the DNS system and purpose.

I used to work in PayPal's anti-phishing group. In fact I was the first engineer on that group. We definitely understood DNS then. We even helped spearhead SPF and DKIM. And we strongly advocated that emails from the company never come from any domain other than PayPal.com

Unfortunately after eBay bought PayPal, they put MBAs in charge, and the marketing team won every argument about the "necessity" of alternate domains to track marketing initiatives.

They never really took into account the lost reputation of users getting constantly phished.

Thanks for that insight. Curious though, why did they not use a subdomain? Would communications. Or paypal-communications. As a subdomain be worse in their opinion?

I'm not really sure. Probably something about tools not respecting or ignoring them or "they don't look as nice" or some other silly reason.

Edit: To clarify, there were a lot of good reasons not to allow them to link to a subdomain, especially they were running marketing software made by other companies, because there is a lot of nasty security issues around cookies with subdomains.

But there was no reason for them not to route their outbound email through a single domain, because the weren't supposed to run 3rd party mailers without deep audits.

Some of the "subcontracted" sites that do marketing stuff are better equipped to handle a top-level domain than a subdomain.

And a subdomain requires negotiating with someone in the bowels of IT, whereas anyone can register PayPal-communications.com

Oh man, this is been my exact experience. You can pretty much chart the growth of a company by watching how much marketing is done with in house teams and how much goes to external agencies.

And as soon as the external agencies are involved, they want as much control as possible. I don’t blame them: setting up DNS entries for some stupid marketing site rarely rises to anyones priorities. So they route around internal controls. Everyone is happier, and everything gets slightly worse.

I've yet to see someone be able to handle a delegated subdomain (where you set subdomain.example.com to have NS pointing at the contractor's setup). Too bad, as it's exactly what it was designed for.

We try to get our enterprise clients to delegate a subdomain to us; the answer is almost always no. "You'd be able to change the records! Oh sure, we can do a CNAME." Sigh.

You generally can't know if a mail is actually from Paypal or not, because they use a huge number of domains to send mails. Just assume everything that says it's from Paypal is fake, much easier.

Pretty much my point, how not using subdomains meant it is very difficult to stop phishing from look alikes.

CIBC sends sensitive emails from "cibc-clientaccountmanagement.com", with an SMTP mail from address of "test@emailservice-inbound-us-prod.adeptra.net" and broken SPF records.

Edit: Is there a website to name-and-shame big companies who screw up SPF/DKIM/DMARC?

Reply on news.ycombinator.com