I'm sure you've heard of gatt.org being the fake website for the WTO. What I'd like to know is, when I'm on the Net, how do I discern the authenticity of the website? I was thinking something like Alexa, but where I don't have to pay to get extra details.
-
2When SSL is used, an extended validation certificate will have information about the organization that runs the site: e.g., while a regular cert might say "this is the real facebook.com," an extended cert will say "this is the real facebook.com, run by the Facebook, Inc. company." Of course, you can't use this to validate an attack site that doesn't have use extended validation cert, so it's not too helpful here.– apsillersJul 18, 2013 at 20:55
-
So what does gatt.org's say, and what does the WTO's official site say?– TrancotJul 18, 2013 at 20:56
-
I think you made a mistake in your question. gatt.org isn't fake, it's merely a (somewhat more accurate) third-party website detailing the WTO.– Fake NameJul 19, 2013 at 5:38
-
Oh, no. I'm aware of your position on the matter, but the website is not hosted by genuine WTO officials. I tend to agree with the accuracies you speak of.– TrancotJul 19, 2013 at 16:21
Add a comment
|
3 Answers
It doesn't seem like you are asking how to determine if a site is posing as the 'real' site, which would be phishing, but what you are really asking is how to validate the content of a site, which is more of a philosophical question than a technical one. How does one determine, for instance, that The Onion is not a real news site?
We can check the 'whois' information for the domain to see if it makes sense, but even then, there might not be enough data to go on. SSL certs might help to provide extra data, if one is used and not faked.
We can use Google searches to search for likely 'true' sites and compare, but that has its own obvious limitations.
How, then, can you determine that an otherwise legitimate site is offering valid and true information? You need to validate. Just ask wikipedia. They hope that with enough eyes and hands, the truth should bubble to the surface, but that is only marginally effective.
This goes back to the very first advice handed out when websites started to become popular: use your head and don't believe everything you hear.
answered Jul 18, 2013 at 21:19
-
3
-
apsillers comment of using extended validation certificate is correct extended validation gives you an extra boost in confidence you're at the right place. For sites that don't have that certificate though a few things you can do.
- Never click a link in your email that has an ip address instead of url ie. 25.35.11.226/index.php That URL just spells trouble.
- Keep a watchful eye out for clever missspellings like WT0.com or W70.com instead of WTO.com with a longer URL the typos are less evident.
- Don't click the link type it in manually or google it. Of course once you're on the site you should be ok you don't need to type out every URL.
- You can never be 100% sure. someone who has stolen a company private key and can somehow forward DNS on the internet to their ip address with that URL will bypass all of that stuff. In DNS root servers we trust.
- There are security features in the latest browsers that attempt to warn you of fake sites. They are helpful but can't be 100% trusted.
answered Jul 18, 2013 at 21:13
This is not a question answerable by technology.
What you're asking is how do I know if the site I want is the one I'm visiting. Which is a bit like saying: "how do I know if the phone number I'm dialing is the person I wanted to call" You're asking your computer to divine your unspoken mental intent rather than your instructions, which always leads to failure.
Instead, what you might do is look at what sites are popular. If I want to find out more about the Python programming language, type "python" into Google. Sites will be ranked according to relevance and popularity. Whichever one is most common will show up at the top.
This will still not always tell you what you want, because that's impossible. But it will tell you what other people want. And that's pretty close.
