Security rant argues phishing succeeds because login flows obscure company domains

The rant centres on a concrete failure: authentication flows that force users through a chain of third-party domains. Every redirect trains users to ignore the URL bar, because even the legitimate flow looks indistinguishable from a phishing page. Once users stop checking URLs, the only remaining defence is the visual design of the page itself, which attackers can trivially copy.

The critique extends beyond login pages. Any link sent via email or SMS that points to a domain outside the organisation’s root domain normalises the behaviour that phishing exploits. The author insists that every external link should be wrapped in a redirect under the organisation’s own domain, so users only ever see a single, trusted hostname. This rule applies equally to phone numbers and contact details, which must be published on a web page linked from the original message.

DNS is not the root cause, but the current use of DNS actively undermines security. The hierarchical structure of DNS is designed to make ownership clear, yet organisations routinely delegate authentication to third-party domains, eroding the one reliable signal users have. The author argues that this practice is not a technical necessity but a design choice, and that reversing it would restore the URL bar as a meaningful security indicator.

The proposed fix is simple in principle: every authentication prompt must appear under a single, well-known root domain controlled by the organisation. Internal services must use subdomains of that root, and no external domain should ever host a login page. While this does not require self-hosting, many services allow custom domains, it does require organisations to enforce a consistent policy across all channels, including email, SMS, and support calls.