The Post Office leaves themselves open to this, because their site is at a level of tech that makes it hard to distinguish from a spam site from 5 years ago. It's too easy to make the phishing site look more legit than the actual site.
I just went to https://www.usps.com/ and it looks perfectly fine. Loads quickly, layout is clean. Maybe this is a joke about modern webdev being terrible that has gone over my head?
It sort of is - the design looks bad, but you're right. The website loads too fast, almost. I would just move to usps.gov and maybe make the design look less like a template I could buy for $30.
How would that new design not become the next $30 template? Do we just have to redesign everything important every few years so they avoid the old/commodity look?
It is actually very easy to copy some HTML from a legit site for the purposes of a phishing campaign. I don't think improving the web design will help mitigate that, unless you mean moving all rendering to a canvas element and implementing all of the functionality of the site on some obfuscated VM.
Comments
The Post Office leaves themselves open to this, because their site is at a level of tech that makes it hard to distinguish from a spam site from 5 years ago. It's too easy to make the phishing site look more legit than the actual site.
I just went to https://www.usps.com/ and it looks perfectly fine. Loads quickly, layout is clean. Maybe this is a joke about modern webdev being terrible that has gone over my head?
It sort of is - the design looks bad, but you're right. The website loads too fast, almost. I would just move to usps.gov and maybe make the design look less like a template I could buy for $30.
How would that new design not become the next $30 template? Do we just have to redesign everything important every few years so they avoid the old/commodity look?
I would do what gov.uk does and just have a design that matches all the other goverment sites.
It is actually very easy to copy some HTML from a legit site for the purposes of a phishing campaign. I don't think improving the web design will help mitigate that, unless you mean moving all rendering to a canvas element and implementing all of the functionality of the site on some obfuscated VM.
You forgot the DRM requirement, making sure no one can just screenshot the whole canvas ;)
j/k, of course
I don't really think that's the problem. Not at all.
The problem is that USPS is an easy mass attack target since nearly 100% of people get mail.
If you want to phish people, you need to cast a wide net, and this one is the widest possible one.
What is their level of tech?