undefined | Better HN

0 pointscdancette8y ago0 comments

I think the hard part is how to tell if some site is "similar" to a sensitive site. Do you check just the owner ? (like in the example, but that would prevent any other company named stripe to own an EV certificate)

Or do you check if the domain is similar to another one?

This is a very hard problem. Maybe the similar name approach could work if it displayed just a warning to the user when he visited a site owned by someone with a similar name to a sensitive site.

0 comments

3 comments · 1 top-level

paultopia8y ago· 2 in thread

That's what I was thinking of. A simple "hey, just so you know, this website has a pretty small edit distance from "paypal.com" (or ditto with certificate owner names). If you're trying to go to the big important financial institution that ain't it, but otherwise click here to carry on."

Not perfect, obvs, but would that be an improvement?

cdancetteOP8y ago

And even sometimes, you can have totally unrelated domains, but the site that looked exactly like PayPal, and people don't look at the domain (sometimes the site doesn't even have a certificate)..

Hard to find a solution to this scam problem

yorwba8y ago

If you want to throw machine learning at it, the browser could try to predict what site the user thinks they are on, and highlight any discrepancies.

The data collection necessary to get an accurate model would however be quite invasive, so I'm not quite sure whether I'd use a browser with that ability. Maybe just having visual fingerprints of the most visited sites and serving them as a static model would be enough.

1 more reply

j / k navigate · click thread line to collapse