Underlying tweet thread is here: twitter.com/crdudeyoutube/status/152999… > How about "if you click a link in an email sent by your bank, make sure it goes to your bank's actual web address"? That would be great advice if my bank's IT could keep all their systems within one domain; they can't, and register shit like banknamelending.com. This is a very distressing pattern. So many terrible attempts have been made to verify the identity of the server for the purposes of mutual authentication, and all of them are terrible, and behavior like this (incredibly common!) is part of what makes it untenable. And the banks, etc., will occasionally try to consolidate their pages into their main domain for this reason, but lock down the domain so much that internal teams that want to promote some crazy feature end up having to work around this by launching under a new, sketchy-looking domain because users just don't care. The other trend I hate is to show on a webpage information about identifying bad servers, because it can't help by definition. I ended up login.gov a little while back, and it warns you: > An official website of the United States government > Here’s how you know > Official websites use .gov > A .gov website belongs to an official government organization in the United States. > Secure .gov websites use HTTPS > A lock or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites. That's great! If I had to phish the US government page, I would just include this warning but change it to suit my purposes, because it's not like they'll open the government page to check. "How do you know if this is an official US government website? Official US government websites always use either .gov or .ru"

> Underlying tweet thread is here: twitter.com/crdudeyoutube/status/152999… Yes, as I said elsewhere, if you open the chart you can click on any node to take you directly to that tweet, including the initial one.