Hacker News Reader

Comment by phendrenad2 | Hacker News Reader

> So the next idea is to register the domain as a subdomain

I think the problem is, someone in the IT department understands the high risk associated with handing out subdomains, so they refuse to do it. So other parts of the company "work around" this by registering their own domain name.

I wonder how companies like Google handle this. A subdomain of google.com is probably the most valuable hack target in the world, but google does use subdomains occasionally (...or maybe more than occasionally! https://gist.github.com/abuvanth/b9fcbaf7c77c2954f96c6e55613...)

View on HN

Nearly. It almost certainly never even touched IT.

The issue is that marketing is organizationally separate from IT and doesn't want to interact with them. IT is probably behind a slow, outsourced ticket based process and will take weeks to do a simple thing. They may also have random opinions about stuff marketing doesn't want them to have opinions about. So building out promos like this is delegated to SaaS services or contractors who also have no relationship with corporate IT. Then nobody in marketing really knows or cares what a subdomain is, because everything they do is just searching Google or clicking links. They never look at the address bar because it's always full of meaningless junk so why would they or anyone else care what's in it?

Anti-phishing training doesn't make sense, when you look at how people really use the internet. Not many people look at the actual text of a URL. The best anti-phishing training is "go to google and type what you're looking for, only click links from there" and not "carefully examine the domain name to try and intuit if it's owned by the organization you think it is".

Have you tried what you're recommending without an ad block extension recently?

I never use adblockers, so yes.

Doesn't need to be IT being slow. I've seen it happen--we warned the guy to talk to us before putting up the new website. Admittedly, I was on the other side of the world and only reachable by e-mail, but the other guy was there in his office.

I don't know if he ever truly understood how he took out all company e-mail for nearly a week.

And trust links from Google? Keep up with the times! Sometimes the first hit is the scammers.

Google handles it in the same shitty way. They send mails that could be phishing mails and use not only google.com but many other weird domains like goo.gl or foobar.google and so on.

Terrible. The times were one could rely on them have long passed.

Reply on news.ycombinator.com