This week, Google introduced the [WayBack] Phishing Quiz, a series of questions to see how good you spot phishing emails.
It is a perfect example on why Google AMP is a bad idea: it makes it easier to write phishing mail targeting Google users.
One of the questions is about a password change email seemingly from Google with a link by Google.
The link is really deceptive, as it:
- uses Google AMP (Accelerated Mobile Pages) which are hosted directly through a root path on the Google main domain: the URL starts with https://google.com/amp
- Especially on mobile, Google accelerates a lot of things through Google AMP, so a link on mobile that looks like this might be legit
This will deceive a lot of people as they are trained to look at the main domain to assess authenticity: google.com
That combined with an email domain that also looks being from Google (with so many real word top-level domains, many would not be surprised getting email from no-reply@google.support)
Just look at the below screenshot to see how deceptively this trick is.
Solution
Read the rest of this entry »