"For safety, don't click suspicious links"
Meanwhile, most organization's login flow redirects through:
# This is a real example, but I've changed the names to avoid pointing fingers https://www.[name of company].com /squawk/ https://login.[name of company].com / https://login.smallcrow.com /324aa78a-03a6-66fc-23e1-4124fdsa213 https://experience.crow-cloud.com /[name of company] /auth https://flock.auth.bird-security.com /authorization https://api-deadbeef.bird-security.com /oauth/v1/authorize?token=DeAdBeEf https://api2.bird-security.com /2fa https://www.[name of company].com /cool/bird/ https://experience.crow-cloud.com /[name of company] / https://www.[name of company].com /squawk/
Neither the username, password nor 2FA prompts are hosted on the company's own domain. Combine that with token expiration triggering random authetication pop-ups, it becomes nearly impossible to notice phishing... because the real thing looks identical to a scam:
All an attacker has to do is write a website with a password box and the company logo. The URL doesn't matter because users have learned to ignore it.
I'll admit that URLs aren't the most intuitive things, because the reading direction alternates. Hostname and scheme start specific and become more general, while the path is the other way around:
https ://funnies .maurycyz.com /memes /crow_hobbies.jpg | | | | | | | | | | | |(most significant) | | | +------------ 1. Top level domain | | +------------------ 2. Operator | +--------------------------- 3. Server name +------------------------------------ 4. Protocol | | +-----|- 5. Directory +- 6. Filename(least significant) This URL is for crow_hobbies.jpg, located in thememes folder of the HTTP daemon on thefunnies server run bymaurycyz.com
As a result, the important bit (the second level domain) is in the middle of the URL. This is something non-technical users must be taught: simply telling them to "avoid suspicious links" isn't enough.
However, the whole excersise is pointless if hostname isn't a reliable indicator.
For users to have any chance of spotting a scam...
An organization MUST use a single, well recognized, root domain. Internal services MUST be on subdomains of the root and MUST NOT use URLs like:
# All these look like scams. Don't normalize scammyness! https://[name of company]-auth.com/ https://[name of company].someone-else.com/ https://someone-else.com/[name of company] https://auth.someone-else.com/[big UUID]
This is obviously important for login pages (since impersonating them would allow stealing credentials), but it SHOULD be applied everywhere to build good habits and prevent social engineering.
Links sent by email or SMS MUST be under the recognizable domain. If it's absolutely necessary to point users somewhere else, create a local redirect or link:
https://[name of company].com /survey -> https://crow-survey.com /[name of company].
This does not mean everything has to be hosted by the organization: many services allow bringing your own domain and links are free.
This rule also applies to phone numbers: do not send an SMS or email telling users to "call 0491-570-006", because there's no way to know if it's a scam. Contact details MUST be provided on a web page linked from the original message.
The hostname situation has gotten so bad that I've seen people arguing that it's a problem that subdomains exist, because it allows criminals to impersonate anyone they want with no oversight.
DNS is a hierarchical system who's structure hasn't changed in 40+ years:
There should absolutely no confusion over who runs any given website... except that it's standard practice to put great effort into making legitimate sites indistinguishable from scams.
(not even governments consistently use their assigned TLDs)