A rant about phishing: It's not the user's fault (and not DNS either)

Is the converse true as well, that only banks can have numbers that start with 1600?

See also Thanks FedEx, This is Why we Keep Getting Phished (previously, on Lobsters), as well as Stop Giving Impossible Advice: Telling People to Watch Out for SUSPICIOUS EMAILS is Nonsense.

It's so bad that sometimes I and my colleagues report the official emails as phishing emails just to make the point.

Combine that with constant login expiration triggering random authetication pop-ups, it becomes nearly impossible to defend against phishing... ... because the real thing looks indistinguishable from a scam [...] All an attacker needs to do is write a website with a password box and the company logo. The URL doesn't matter at all because users learn to ignore it.

This reminds me of Security Chaos Engineering by Kelly Shortridge:

But at the bedrock of this focus on “culture”—no matter the industry—is its bellicose insistence that the humans intertwined with systems must focus more on security (or “safety” in other domains). [...] Hence, we see an obsession with preventing users from clicking on things, despite the need in their work to click on many things many times a day. One might characterize the cynosure of infosec “security culture” as preventing people from clicking things on the thing-clicking machine [...]

Discussions about culture offer little impact without being grounded in the reality of the dynamic, complex systems in which humans operate.

When I first read this, it was so "d'uh!" to me that I thought that anyone who really thinks about security, especially professionally, would already have this internalised. but, uh, apparently not.

I was going to link to Troy’s fedex post

The number of companies that seem to go out of their way to train users to click on phishing links is stunning.

I think the only fix is to make companies lose liability protection if they don’t follow sensible rules like this

I appreciate the angle of not wanting to shame the guilty... But I will! Workday is TERRIBLE for this. Even including really phishy urls in genuine email comms.

I see this alot at my current and several of my previous employers where a myriad of new, separate domain names are registered for different things - both internal services as well as external efforts. I'm a technologist, so i'm primed to be skeptical about link and domains to be clicked...but other folks in the orgs that i worked for would be genuinely confused because they've been slowly taught that some links do not exist under their root corporate.COM. Its certainly not a technical issue so much as a training and process opportunity. Training both for the employees doing the clicking, but also for the teams that sponsor these separate websites that choose these separate domain names. And process, because either the sponsors for these new, separate websites either don't know that a process might exist for requesting new subdomains for their project, or they know the process but hate it and circumvent it. None of this is overtly complex...there simply needs to be a willingness to do things right...and the sad thing is that if/when done right, it actually may save a little bit in cost savings (e.g. less training needed, less security scan tool costs, less costs for managing requests that are outside the normal subdomain requests, etc.). Ok, sorry, i guess i just went off on a mini rant myself. Sorry, not sorry! :-)

I was surprised that Kanidm (a self-hosted OIDC provider that aims to raise the security floor) recommends a separate domain as the "safest" place to host your IDM:

Running Kanidm on a separate top-level domain makes it much easier to restrict changes that could affect your IDM infrastructure. For maximum security, your Kanidm domain name should be a subdomain of a top-level domain (or domain under a public suffix) that has no other services assigned it. In this example you own example-auth.example which you would operate in parallel to example.com.

(Emphasis in original)

They also say hosting on a subdomain of your main domain is fine, but I was surprised there wasn't more concern given to the phishing risk of choosing a separate domain. Especially for auth, as mentioned in the article.

I think it's also worth considering how advice like this promulgates. Are there ways we can make it safer by default to host auth on the main domain (or a subdomain of it) without requiring arcane knowledge of what actions on other domains could put it at risk?

I'm a bit disappointed that https://funnies.maurycyz.com/memes/crow_hobbies.jpg turned out to be a dead link