4 ms·

Looks like an excellent target for phishing attacks!

by jser 13y ago

unclebucknasty 13y ago
No kidding. That step 3 is a doozy: >The recipient will be emailed a link to easily deposit their cash to their bank. You have to wonder about the wisdom of training people to view such emails as legitimate.
- cormacrelf 13y ago
  They just got an email from you. Not so suss.
  - garethadams 13y ago
    No, they just got an email from someone that happened to have my address in the `From` field. Since we're in the realm of phishing already, let's not forget that people still commonly enter their email address and email password into sites claiming to "Find your friends who are using this service". The problem with social attacks is that they spread socially, and it's not enough for just "some", or even "most" people to be educated for it to be stopped. I don't think Square are ignorant about this, but I'd like to see some confirmation that some measures are in place to counter threats like these.
    - makomk 13y ago
      What also doesn't help is that sites like Facebook leak personal information like sieves. I've been receiving the spam e-mails claiming to be from various of my Facebook friends for some time.
  - unclebucknasty 13y ago
    In the happy case, yes. But, that doesn't consider how phishing works. So, Square trains people that these e-mails are OK. In the happy case, you get the email from a friend, followed by a link/invitation from Square. Everything is fine. After doing this several times, one day you just get the email that appears to be from Square, informing you that you have money. This is a phishing email and there is no email from a friend, which should raise a red flag, but for many it won't. Or they may just think Square changed the process. Putting the onus on the user to discern this is not a good plan. Training users to click a link from an email that resulted from a process they didn't initiate, then enter personal/financial information or credentials is not a good idea.
- dangrossman 13y ago
  That's a mail people have been receiving for 15+ years from PayPal.
downandout 13y ago
That was my first impression. I could rip the site, post it to my own domain, and start sending out emails saying "you've got cash, give me your credit card number so we can credit it" in about 10 minutes. Great concept, and I plan to use the service, but as it gains momentum and acceptance, it's going to be a great attack vector for the Nigerians.
- iambateman 13y ago
  All online business ever is a great attack vector for "Nigerians."
- viiralvx 13y ago
  As a Nigerian, I'm offended. You know, other countries scam too!
  - skore 13y ago
    After getting to know a Nigerian[0], I must say this constant jab against Nigerians is getting annoying to me as well. [0] http://valanx.org/index.php?option=com_content&view=article&id=145:power-to-the-developers-nigeria&catid=25:skore-blog&Itemid=99 http://valanx.org/index.php?option=com_content&view=article&...
philfreo 13y ago
So is PayPal and just about every other financial institution. Square has some nice safeguards in place here and considering they are going to be the ones paying for fraud abuse, you can be sure they'll be doing everything possible to prevent it.

Looks like an excellent target for phishing attacks!

by jser 13y ago

Looks like an excellent target for phishing attacks!

No kidding. That step 3 is a doozy: >The recipient will be emailed a link to easily deposit their cash to their bank. You have to wonder about the wisdom of training people to view such emails as legitimate.

cormacrelf 13y ago
They just got an email from you. Not so suss.
- garethadams 13y ago
  No, they just got an email from someone that happened to have my address in the `From` field. Since we're in the realm of phishing already, let's not forget that people still commonly enter their email address and email password into sites claiming to "Find your friends who are using this service". The problem with social attacks is that they spread socially, and it's not enough for just "some", or even "most" people to be educated for it to be stopped. I don't think Square are ignorant about this, but I'd like to see some confirmation that some measures are in place to counter threats like these.
  - makomk 13y ago
    What also doesn't help is that sites like Facebook leak personal information like sieves. I've been receiving the spam e-mails claiming to be from various of my Facebook friends for some time.
- unclebucknasty 13y ago
  In the happy case, yes. But, that doesn't consider how phishing works. So, Square trains people that these e-mails are OK. In the happy case, you get the email from a friend, followed by a link/invitation from Square. Everything is fine. After doing this several times, one day you just get the email that appears to be from Square, informing you that you have money. This is a phishing email and there is no email from a friend, which should raise a red flag, but for many it won't. Or they may just think Square changed the process. Putting the onus on the user to discern this is not a good plan. Training users to click a link from an email that resulted from a process they didn't initiate, then enter personal/financial information or credentials is not a good idea.
dangrossman 13y ago
That's a mail people have been receiving for 15+ years from PayPal.

downandout 13y ago

That was my first impression. I could rip the site, post it to my own domain, and start sending out emails saying "you've got cash, give me your credit card number so we can credit it" in about 10 minutes. Great concept, and I plan to use the service, but as it gains momentum and acceptance, it's going to be a great attack vector for the Nigerians.

iambateman 13y ago
All online business ever is a great attack vector for "Nigerians."
viiralvx 13y ago
As a Nigerian, I'm offended. You know, other countries scam too!
- skore 13y ago
  After getting to know a Nigerian[0], I must say this constant jab against Nigerians is getting annoying to me as well. [0] http://valanx.org/index.php?option=com_content&view=article&id=145:power-to-the-developers-nigeria&catid=25:skore-blog&Itemid=99 http://valanx.org/index.php?option=com_content&view=article&...

philfreo 13y ago

So is PayPal and just about every other financial institution. Square has some nice safeguards in place here and considering they are going to be the ones paying for fraud abuse, you can be sure they'll be doing everything possible to prevent it.