Hacker News Reader

Comment by e40 | Hacker News Reader

I'm still blown away that most of the banks I do business with send URLs in emails. I once tried to explain why this was a bad idea to a customer service rep. What a waste of time.

View on HN

I'm just curious as to why it's a bad idea? I click URLs in emails all the time. I just hover over it to make sure that the hyperlink matches the text. Is there another possible security issue that I'm missing?

Check out the first sentence/paragraph of this post: http://feross.org/html5-fullscreen-api-attack/

(from https://news.ycombinator.com/item?id=4629906)

Most mail clients won't execute javascript, though.

Very interesting. I suppose it would only affect browser based email clients, but a lot of the non-tech-savvy people I work with use the web mail client exclusively, so that is definitely an issue.

I'm still baffled why I was downvoted into negative territory for my original comment.

Don't worry too much about it. I say incredibly useful and 100% correct things all the time and people still downvote me sometimes!

Most users don't hover

Really, I can't believe I'm being questioned on this. Hasn't everyone here heard of phishing? Just because it looks legit doesn't mean it is, especially if you are using IE or a really old browser with bugs.

Of course we've heard of phishing, but checking the actual hyperlink rules that out. Your example is an extreme edge case, and the people using those browsers have plenty of other security issues to worry about.

Besides, I was genuinely curious. I know about phishing, but I don't know if you had anything else in mind. I learn a lot from the HN community.

but checking the actual hyperlink rules that out

Even if (and that's a big if) the hover-over doesn't fake you out because of a bug, are you willing to make sure you don't suffer from any of the problems in this?

http://en.wikipedia.org/wiki/Phishing#Link_manipulation

Depending on the email client, JavaScript can be used to trick you about the destination URL.

You're relying on brain that has ingrained, complex, pattern matching "functions" that have many known exploits. See various optical illusions, and it deosn't mttaer in waht oredr the ltteers in a wrod are, the olny iprmoatnt tihng is taht the frist and lsat ltteers be at the rghit pclae.

Also issues with fonts having identical visuals for one and el and sometimes lower case eye, capital oh and zero, etc. And soon, probably (already?), unicode and other escape codes in urls.

DON'T RELY ON HOVERING OVER.

The number of layers of management between a CSR and someone with actual decision-making authority at a bank is staggering. The entire financial industry is more like fast food than it is like, say, medicine. In medicine people regularly interact with doctors who actually know what's going on. In the financial industry, the vast majority of workers have no clue how it works under the hood. They are mostly technicians and sales people. Unless you have made a concerted effort (it took me four years) you have almost certainly never interacted with a banker with actual decision-making authority.

It makes more sense than doing it over the telephone. I'm not sure how you expect them to send URLs. If you are sophisticated enough not to need a URL emailed to you, then you won't need it, but I don't see a practical alternative for other people.

Tell me, what URL could a bank need to communicate to me in email that they couldn't replace with instructions like "login and click on ..."?

People will also follow re-key instructions taking them to phishing sites. They'll tell strangers their passwords and download and run unique video codecs (aka malware) to watch some special comedy video file they've been sent by a friend. The answer is to educate your friends, family and any stranger who will listen to perform some critical analysis on an unsolicited approach by e-mail, phone, sms, or whatever.

Well, the obvious if somewhat facetious answer here is "the URL to log in." Another, less facetious one is "a password reset link." But even if we accept that expecting customers to follow long lists of directions without error is remotely reasonable, it doesn't matter because scammers are certainly not going to be fastidious about avoiding links, so by avoiding them yourself, you are only making it more convenient for your customers to get scammed than to actually do business with you.

I can see the value in not blindly visiting URLs received via email. I do not see the value in refusing to send links via email. Unless you yourself are a scammer, making people do error-prone extra work to access your site does not protect anyone from getting scammed.

Can you explain here, why it is bad idea to send URLs in emails?

It gets people used to clicking URLs in emails. This is a bad habit.

if people really cared, they'd follow The Rules. How many other conveniences do we drop? I rarely click links in e-mail, but my non-technical eternally trusting-of-strangers friends will always be tricked into doing stupid stuff. If it's not links in e-mail, it's pop-up-windows, or salesmen with extended warranty.

Ignorant people aren't fungible, they're people. The more idiot proof you make things, the more idiots you save - it isn't binary.

>How many other conveniences do we drop?

We evaluate them on a case by case basis, because we're thoughtful people.

Phishing. And a comment above: https://news.ycombinator.com/item?id=8243227

Eh, AFAICT, from the bank's perspective, it's a matter of convenience that can be written off with insurance.

Reply on news.ycombinator.com