A rant about phishing: It's not the user's fault (and not DNS either)

Argues that phishing susceptibility isn't primarily a user education failure or a DNS design flaw, but a consequence of poor organizational practices. Many companies route login, password, and 2FA flows through third-party auth vendor domains rather than their own recognizable root domain, making legitimate authentication flows visually indistinguishable from scams. The piece walks through how URL structure is read (reading direction alternates, making the second-level domain the meaningful trust anchor buried mid-string) and proposes rules organizations should follow: use a single recognizable root domain, keep internal services on subdomains of it, never redirect auth or contact links to unrelated third-party domains, and avoid sending bare phone numbers or off-domain links in emails/SMS.

Source: https://maurycyz.com/misc/domains. 8 Sync News only summarizes and links out; content copyright belongs to the authors and original sources.