A rant about phishing: It's not the user's fault (and not DNS either)

Phishing attacks are a major issue, and it's not the user's fault or even the responsibility of DNS systems. Many organization's login processes redirect users through external domains, making it nearly impossible to distinguish genuine from fraudulent websites. Attackers only need to create a site with a password field and a company logo, and users often overlook the URL details due to their unintuitive structure.

URLs follow a hierarchy, with the top-level domain appearing in the middle, which is easily overlooked by non-technical users. Simply telling users to avoid suspicious links isn't enough, as the hostname itself may not be a reliable indicator of authenticity. Organizations must use a single, well-recognized root domain, and all internal services should be subdomains of that root.

Links in emails or SMS should all come from the recognizable domain, and if a redirect is necessary, it should be to a local redirect or a link under the company's domain. Phone numbers should also be provided on a web page linked from the original message. The current situation has reached a point where some argue that subdomains make it too easy for criminals to impersonate any website they want, despite DNS being a stable, hierarchical system that has remained largely unchanged for over 40 years.