3 ms·

> Users need to stop clicking on links they get out of the blue over E-mail, and legitimate companies need to stop sending links they expect customers to click

> Users need to stop clicking on links they get out of the blue over E-mail, and legitimate companies need to stop sending links they expect customers to click I agree with the first part, but how is the second part supposed to work? We're using links to easier guide people in the "right" direction (depending on who "you" are, changes what "right" means), what could an alternative be? So, a X just finished, and the user can now use it. In my notification to the user, how to guide them to that specific X?

ryandrake 7y ago
I think the key is whether the E-mail is unsolicited. Request a password reset? The E-mail is solicited and expected. Just bought something from an online store? The receipt E-mail is solicited and expected. In these cases, users should not feel it's particularly risky to click the links, because they are currently interacting with the site. On the other hand, "Hi! We noticed there is a scary-sounding problem with your account, please click here to fix it!" No legitimate company should be sending users something like this out of the blue, and users should be trained to immediately think fraud/scam when they receive this.
- capableweb 7y ago
  So you bring up a good example. Imagine something scary happened to the account, and the user needs to provide some additional details or fix something. How can I as a company inform the user about this and get them to fix this? The incentive from the senders side is to get the person receiving it to do something. If that's good or bad, it's harder to say than draw a line in the middle. Currently, bunch of companies and other entities are finding the whole clickbait super useful, and it's only natural that bad actors take advantage of this. But who is the bad actor? Turns out a lot of them, but on different levels.
  - ryandrake 7y ago
    How would you do it if, instead of the E-mail address, you had the customer's phone number? You probably wouldn't call them out of the blue and ask them to do something, since that seems scammy. So why should a security-minded user treat an identical conversation over E-mail differently? Is this need real though? I can't think of a legit example where out of nowhere (i.e. not in the context of some transaction I'm currently doing with them), a company would suddenly need me to fix something, do something for them, or provide them information.

ryandrake 7y ago

I think the key is whether the E-mail is unsolicited. Request a password reset? The E-mail is solicited and expected. Just bought something from an online store? The receipt E-mail is solicited and expected. In these cases, users should not feel it's particularly risky to click the links, because they are currently interacting with the site. On the other hand, "Hi! We noticed there is a scary-sounding problem with your account, please click here to fix it!" No legitimate company should be sending users something like this out of the blue, and users should be trained to immediately think fraud/scam when they receive this.

capableweb 7y ago
So you bring up a good example. Imagine something scary happened to the account, and the user needs to provide some additional details or fix something. How can I as a company inform the user about this and get them to fix this? The incentive from the senders side is to get the person receiving it to do something. If that's good or bad, it's harder to say than draw a line in the middle. Currently, bunch of companies and other entities are finding the whole clickbait super useful, and it's only natural that bad actors take advantage of this. But who is the bad actor? Turns out a lot of them, but on different levels.
- ryandrake 7y ago
  How would you do it if, instead of the E-mail address, you had the customer's phone number? You probably wouldn't call them out of the blue and ask them to do something, since that seems scammy. So why should a security-minded user treat an identical conversation over E-mail differently? Is this need real though? I can't think of a legit example where out of nowhere (i.e. not in the context of some transaction I'm currently doing with them), a company would suddenly need me to fix something, do something for them, or provide them information.