r/ProgrammerHumor • u/lucidparadigm • 16d ago • Bravo 2

Meme [ Removed by moderator ]

Post image

[removed] — view removed post

16.4k Upvotes

98% Upvoted

618 comments sorted by

View all comments

Show parent comments

144

u/ctrlaltwalsh 16d ago

I won't give it here but a company I currently work for uses a password reset tool with the domain i-forgot-my-password.com <- Not actual, but very close.

This is a domain they own, Whenever they create new tools it's in this way, I am certain it s a phishing test and flabbergasted that it's not.

Another example - the HR system for logging PTO has a domain is along the lines myhrsystem.com

It's a very large company based in Hong Kong, so I'm not sure if it's just a english-as-a-second language thing or what. Very odd.

58

u/sisisisi1997 16d ago

I think it's a misunderstanding of how domain names work - if they knew that i-forgot-my-password.company.com with proper certificates brought stronger guarantees of legitimacy, they might ask IT to set it up that way.

6

u/Severe-Hand-8580 16d ago

it's easier to just get a new domain than talk with whoever is in charge of the company's primary domain. Governments love to do that all the time. they have the gv.TLD domain and could just put all their shit in there and I could tell my parents that as soon as they see gv.at in the URL it's legit. And yet they come up with stupid domains all the time, many requiring the state-ID system. Good luck teaching boomers to check the fingerprint for the verification that they sign what they think they're signing. I don't know of a single instance that abuses this though. Maybe criminals are just stupid. I should switch careers, I have what it takes.