3

Hope I have chosen correct forum to ask this question.

The other day it happened to me. I got e-mail from my admins requesting me to update my password. "Not again" I mouthed and clicked the link.

Luckily, I am always checking URLs, which saved me this time. I clicked phishing e-mail. The site looked really like Microsoft Office (we use Microsoft Outlook) and it wanted me to first enter my current password.

At that moment I already knew I have to be cautious about next steps and was investigating what I can do about my visit to the phishing site.

Being already angered, I was thinking about submitting here something really really offensive as my "current" password.

Obviously, I do not use swear words as my password, I follow usual guidelines in how to create passwords.

At the end of the day, I did nothing, but the question still pings in my head: Would posting fake password to phishing site help anything in regards of my personal security and/or my company security?

P.S: I notified IT department about the mail, so the company is aware about this phishing attempt

1
  • 2
    Just a note that even visiting a phishing site could potentially be harmful. For example, dangerous malware could have been downloaded to your computer. It’s best to stay away altogether from phishing sites.
    – CoderPE
    Nov 11, 2018 at 20:52

3 Answers 3

7

No, this probably isn't a good idea. Oftentimes, scammers who send emails like that don't actually try out every single password manually but instead use a script that inputs them automatically. In that case, they wouldn't see your message and so it would just be a waste of time.

On the other hand, some people enjoy messing with scammers. A somewhat audacious technique that I have seen tried in the past is to write your own script to repeatedly fill the password field on the phishing site with random data in hopes of drowning out the passwords of people who had fallen for the scam.

As @CoderPE mentioned in the comments, drive-by downloads and exploit kits can be used to compromise a computer just by visiting a website (usually on Windows, although other operating systems can also be affected).

3

It depends on your resources and knowledge.

If you are sure you can protect your system against the attacker, go ahead and do it. Do it thousands of times using a script, posting as much fake data as you can. You are helping the ones caught by the scammer, by polluting his database with so many wrong entries that he may throw all the credentials away.

On the other hand, if you don't trust your knowledge level, your system's protection measures or don't want to bet your system, don't even click on phishing links. It's safer for you.

3
  • Having to "trust your knowledge level" when putting yourself at risk doesn't sound like good Information Security advice, does it?
    – Masclins
    Nov 22, 2018 at 16:14
  • 2
    Yes it does. If you have experience working on security, you know the risks and how to mitigate them. I could safely do that. If someone doesn't have knowledge but have a spare machine fresh installed without anything of value inside, he can too.
    – ThoriumBR
    Nov 22, 2018 at 16:19
  • If you are very very clever, I feel like you could do some very interesting things like submitting eicar files (which prompt a false positive test on anti-virus) or other things like that so a poorly run scammers site would have 'illegal strings' in their logs which cause problems. I wouldn't trust myself to do it, but it would be very interesting!
    – Panky
    Jul 30, 2023 at 18:52
0

No, every password you produced, actually, leaks information from you, from your personality, your knowledge... The more you enter the more they will contain information to your passwords. Eventually, they will break you.

2
  • 2
    I don't see how every password produces information about you. For example, you could just post passwords from a dictionary.
    – forest
    Nov 12, 2018 at 1:44
  • If nothing else, it confirms your e-mail address, and it confirms that the company's mail filter didn't delete the phishing mail. So...
    – Damon
    Nov 12, 2018 at 14:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .