7 ms·
Operation Luigi: How I hacked my friend without her noticing (2017)
- 5555624 8y agoPosted numerous times, a year ago, including: https://news.ycombinator.com/item?id=14919845 https://news.ycombinator.com/item?id=14919845
- baud147258 8y agoOn the site (https://mango.pdf.zone/ https://mango.pdf.zone/), the above link is called 'Salty Hacker News comments'
- bspammer 8y agoThat's pretty funny. I didn't like the writing style at first either, but it got funnier as I carried on (or maybe the writing got better too). By the end I was questioning why I was so resistant to light-heartedness in the first place. Overall, a really great breakdown of a textbook phishing attack.
- lgierth 8y agoThis is certainly not how trust in human relationships is reinforced :) Get consent before hacking your friends.~~ Edit: This is awkward - I was sure I read it one of the previous times it was posted. Chapeau!
- hyperpower 8y agoDid you read the article? The author got consent.
- craftyguy 8y ago> Please don't insinuate that someone hasn't read an article. "Did you even read the article? It mentions that" can be shortened to "The article mentions that." https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- smus 8y agoTo be fair to the above it's a pretty central factoid that is mentioned more than a few times, but yes, I agree with you.
- mnw21cam 8y agoConsent was obtained, as described in the article.
- NPMaxwell 8y agoThis is an interesting model for how to provide training/education
- edoo 8y agoBanks and the rest hate me. I use keypass to generate random alpha numeric 'passwords' I use for the answers to personal questions.
- RickS 8y agoWhat are some of the ways this blows back? Having to answer them over the phone when they're not passwords, but more like customer service gatekeepers? I do this as well and it has yet to blow up in my face, though it does seem like an inevitability.
- edoo 8y agoI used to do a slightly different system where I'd have ridiculous answers, sort of a word game play on the question itself, and forgetting your secret answers with a company like Verizon can take days to figure out.
- AckSyn 8y agoI do this but instead of passwords like `NGIyNzgwMTEyNDczYTIyNjEwYWRhYWZh` I'd use `BatteryHorseStaple33` to the question: Where were you born. I've never had it blow up in my face with any rep, and I make sure to keep the passwords in an offline (never touches any network) laptop.
- captn3m0 8y agoMy bank (HDFC India) specifically states while setting up the security question that the bank will never ask for these (over phone or elsewhere), so I'm happily using random UUIDs
- Insanity 8y agothe content of the article is good - but the writing style does not sit well with me. It's an odd sense of humour and a writing style more suited to instant messages perhaps rather than a blog.
- deleted 8y ago[deleted]
- Sileni 8y agoEh, I liked it. Many writers in the tech space are trying to be as concise and clear as possible. If this article had been more 'academic' in that sense I think I would have lost interest after a few paragraphs because, well, nothing in this article is really new. It's just a fun anecdote about the reality of cyber security.
- stevew20 8y agoI use prefer to read concise writing, because it imparts the information I want without all of the distracting fluff. This is also why I don't like a lot of academic writing, as over the years academics have become much more verbose and fluffy.
- deckar01 8y agoGoing off on quirky tangents can be an effective tool for keeping a reader interested. It reminds me a little of Douglas Adams. He punctuates the hard science fiction with goofy anecdotes to get the reader thinking about the subject from another perspective and to keep them entertained. It is not a tutorial on how to phish or a vulnerability report, but rather a story about how motivation is potentially more important to phishing than technical skill. Without the casual writing style, the main character (and author) might have seemed more sophisticated, which would have diminished the point of the story.
- y_tho 8y agoA joke here and there is fine, but this person injects his jokes attempts pretty much every sentence. That gets annoying quickly.
- godelmachine 8y agoThis post periodically makes it way back to the top. Last I checked it was 6 months ago
- rhacker 8y ago> She explains to me how she got an email from Apple about her account and there was a phone number in it. I tug my collar several meters into the next room, knocking over several carefully-potted indoor plants. That line was fucking gold.
- neilalexander 8y ago> Shout outs to Aerobatic for the smooth smooth phishing UX. Use the referral code DIANA to be immediately reported to the NSA. This one definitely got me!
- chilledheat 8y ago"I reach under my desk, unwrap a parcel addressed to “DIRECTOR OF CYBER, NSA”, slide out a yellow and black canister labelled “CHINA”, break open the safety seal, and use safety tongs to extract the following red-hot phish." Gold.
- deleted 8y ago[deleted]
- thunderbong 8y agoMy goal here is to figure out what Diana’s actual password is, given that I have her password hash. This process is commonly known as “hacking”. This is hilarious!!
- mdrzn 8y ago> At this point Diana has been completely gaslighted as to what her hotmail password is, because my phishing site said the wrong password was right, and then said the right password was wrong, and she thinks it’s the real Hotmail. Most underrated footnote.