3 ms·

I think the term "Social Engineering" is making this seem so fun and technical, if we started using the words "fraud" or "identity theft", or "impersonation", m

I think the term "Social Engineering" is making this seem so fun and technical, if we started using the words "fraud" or "identity theft", or "impersonation", maybe companies and lawmakers can give it the legal and enforcement attention this issue desperately needs. Not a judgement of the article or Sophie, more just terminology which makes it difficult for non-technical people to understand the gravity of these attacks

shliachtx 9y ago
She was hired to do this. As explained in the article, the company wanted to test their own security. She is able to revel in her deception because it's exactly what the company wanted from her.
- jaclaz 9y ago
  >She was hired to do this. To be fair, she claims to have been hired ...
  - KGIII 9y ago
    Before you vote them down, she'd say the same thing. Trust but verify.
  - jwilk 9y ago
    If you don't believe her that she was hired, why believe the rest of her story?
    - jaclaz 9y ago
      >If you don't believe her that she was hired, why believe the rest of her story? As a matter of fact I don't believe most of the rest of the story, and - for some reasons - I have been downvoted for expressing my doubt of it sounding "too good/easy to be true": https://news.ycombinator.com/item?id=15517630 https://news.ycombinator.com/item?id=15517630 Maybe I should have called it "not very plausible overall", as there is IMHO too much contrast between the described "high security" context and the extents of what the pentester has reportedly been allowed to do once gained access.
pavel_lishin 9y ago
> if we started using the words "fraud" or "identity theft", or "impersonation", maybe companies and lawmakers can give it the legal and enforcement attention this issue desperately needs. There are already laws on the books for "fraud", "identity theft", and "impersonation." Also, trespassing, theft, cybercrime, etc.

shliachtx 9y ago

She was hired to do this. As explained in the article, the company wanted to test their own security. She is able to revel in her deception because it's exactly what the company wanted from her.

jaclaz 9y ago
>She was hired to do this. To be fair, she claims to have been hired ...
- KGIII 9y ago
  Before you vote them down, she'd say the same thing. Trust but verify.
- jwilk 9y ago
  If you don't believe her that she was hired, why believe the rest of her story?
  - jaclaz 9y ago
    >If you don't believe her that she was hired, why believe the rest of her story? As a matter of fact I don't believe most of the rest of the story, and - for some reasons - I have been downvoted for expressing my doubt of it sounding "too good/easy to be true": https://news.ycombinator.com/item?id=15517630 https://news.ycombinator.com/item?id=15517630 Maybe I should have called it "not very plausible overall", as there is IMHO too much contrast between the described "high security" context and the extents of what the pentester has reportedly been allowed to do once gained access.

pavel_lishin 9y ago

> if we started using the words "fraud" or "identity theft", or "impersonation", maybe companies and lawmakers can give it the legal and enforcement attention this issue desperately needs. There are already laws on the books for "fraud", "identity theft", and "impersonation." Also, trespassing, theft, cybercrime, etc.