4 ms·

I have yet to see a scam which would fool me. And I have seen many already. All the scam and phishing mails I saw in my whole internet career were somewhere b

I have yet to see a scam which would fool me. And I have seen many already. All the scam and phishing mails I saw in my whole internet career were somewhere between totally obvious and embarrasingly blunt. I can't agree with your assessment. If someone is naïve, they are at risk. Same applies for overconfidence. These are personality traits which are easily exploited. In real life as well as on the Internet. We cant protect everyone from everything. Neither in healthcare nor in VR.

quesera 6y ago
> I have yet to see a scam which would fool me. And I have seen many already. That's because you have never been targeted. It's that simple. There is a small segment of society who are: a) savvy, and b) not actively engaged in commerce/business/community/career/friends/family, so any solicitation over email is likely suspicious. Everyone else is at some level of risk. And sometimes it only takes one failure.
- mlang23 6y ago
  Interesting. How do you know that I have never been targeted. Did you ask your crystal ball? Or is it that you just know everything? I am amazed and bow to your skills, great magician. Also, implying that I am not actively engaged with anything is a pretty personal attack. Reserve your patronising behaviour for your children please.
- aidenn0 6y ago
  Even untargeted scams can fool a savvy person by coincidence. I followed my accountant when he switched accounting firms. Within two weeks of that, I got a generic accounting email SharePoint document share. It linked to the actual ms domain and used some redirection trickery to end up on a pixel perfect copy of the office 365 login screen. I only didn't get scammed because my password manager refused to auto fill. Had the email come after I had learned the name of the new accounting firm, I never would have even clicked on the link.
  - ghaff 6y ago
    >Even untargeted scams can fool a savvy person by coincidence. And you can pick them up 99 times out of 100. But that 100th time, you're tired, rushing to get out the door, etc. and they get you. I'm definitely more cautious than I was when phishing was just starting to be a big thing. Back then I don't think I ever fell for anything but there was once or twice when I wasn't really thinking and started down the path of providing information.
fortran77 6y ago
I admire her for doing the right thing, and risking embarrassment and shame, by telling the story to make the rest of us hyper-aware.
notahacker 6y ago
> I have yet to see a scam which would fool me If it fooled you well enough you might not have noticed you were scammed. Scams run from laughably blunt like the Nigerian prince to remarkably close to the real thing, like the callcentre that rang me pretending to sell phone contract upgrades that used exactly the same crap phone sales techniques my actual network used when they (coincidentally) called me a week later, and had a 1-letter different email address with the URL redirecting to the same website
11thEarlOfMar 6y ago
One that was successful at my company recently was an e-mail sent to an electrical engineer from the CEO saying that the CEO needed a gift card from Target for an employee birthday, and had forgotten to pick it up. The EE went to Target and bought the card. The instructions including to reply to the e-mail with the card # so the CEO could include the number in the birthday card and not need the actual plastic. The spoof was believable at first glance. It used the CEOs actual first name and obscured the actual source e-mail address with his company e-mail as the name. What should have given the engineer pause (among other things) was the context. There was no reason that the CEO would ask an engineer to do this task at my company. Nonetheless, the engineer was perhaps overly deferential to the chain of command and the suspicion didn't emerge until he had embarrassed himself.
- Aeolun 6y ago
  Hah, I almost fell for the same thing, but when they asked for 4! $1000 codes! over email! I got a bit suspicious. Could have probably gotten 4 times $50 out of me though.
- pwillia7 6y ago
  That's rough. I got a phishing email from my CEO asking about something similar with money and had a brief 'oh shit' chain of command moment before my incredulousness kicked in. I get it.
- mlang23 6y ago
  Simple. Either call or reply asking him why he didn't send this mail to the secretary. If you can't be so direct with your boss, find another job.
  - 11thEarlOfMar 6y ago
    In this case, it was his boss's boss's boss (I am his boss's boss). This particular engineer is highly valued at the company, including by me personally. It was at the same time surprising, but paining to see his consternation, and I certainly do hope he doesn't leave us. I'll gladly endure a $100 mistake to have his talents and attitude as an engineer.
spoonjim 6y ago
No offense, but you’re likely a “nobody.” So you’ve only come across the generic scams. This is a famous person. The phishing attempt was designed specifically for her. You don’t know if you’d fall for it because 1) nobody would invest that much effort into phishing you, and 2) “we’d like you to come teach at our university” is a plausible thing for her to hear but not you or I.
reddog 6y ago
> I have yet to see a scam which would fool me Maybe not but you will. If you live long enough you will suffer inevitable cognitive decline until one day you will be vulnerable to such a scam. We all will. No amount of good diet, meditation, fish oil and exercise will keep that from happening.
- alisonkisk 6y ago
  mlang23 has commented about being blind, which is a pretty huge filter against Internet scams, which aren't designed for screen readers.
  - mlang23 6y ago
    You pretty much nailed it. I am filtering a lot of stuff because I refuse to use certain modern flashy technologies. Office 365, yeah, go away. Firefox? Only on a dedicated machine if I really need it. Emacs, SSH, tmux, old fashioned email (text only) and a linux virtual console is all I need to be productive, fast and especially happy. A big part of what makes these attacks work is the tech stack in use on the recipients side. I recently heard about a Emotet attack, and was told "Well, you know, the problem is that Outlook only shows the name but not the address by default". Oh well, what can you say about that?
    - Frondo 6y ago
      If any sizeable portion of internet users were also visually impaired, and on a stack similar to yours, you'd certainly see scams targeted at you. Good for you for being so far off the map, though, that is a good protective measure.
- mlang23 6y ago
  We're all gonna die. Some earlier, some later.

quesera 6y ago

> I have yet to see a scam which would fool me. And I have seen many already. That's because you have never been targeted. It's that simple. There is a small segment of society who are: a) savvy, and b) not actively engaged in commerce/business/community/career/friends/family, so any solicitation over email is likely suspicious. Everyone else is at some level of risk. And sometimes it only takes one failure.

mlang23 6y ago
Interesting. How do you know that I have never been targeted. Did you ask your crystal ball? Or is it that you just know everything? I am amazed and bow to your skills, great magician. Also, implying that I am not actively engaged with anything is a pretty personal attack. Reserve your patronising behaviour for your children please.
aidenn0 6y ago
Even untargeted scams can fool a savvy person by coincidence. I followed my accountant when he switched accounting firms. Within two weeks of that, I got a generic accounting email SharePoint document share. It linked to the actual ms domain and used some redirection trickery to end up on a pixel perfect copy of the office 365 login screen. I only didn't get scammed because my password manager refused to auto fill. Had the email come after I had learned the name of the new accounting firm, I never would have even clicked on the link.
- ghaff 6y ago
  >Even untargeted scams can fool a savvy person by coincidence. And you can pick them up 99 times out of 100. But that 100th time, you're tired, rushing to get out the door, etc. and they get you. I'm definitely more cautious than I was when phishing was just starting to be a big thing. Back then I don't think I ever fell for anything but there was once or twice when I wasn't really thinking and started down the path of providing information.

fortran77 6y ago

I admire her for doing the right thing, and risking embarrassment and shame, by telling the story to make the rest of us hyper-aware.

notahacker 6y ago

> I have yet to see a scam which would fool me If it fooled you well enough you might not have noticed you were scammed. Scams run from laughably blunt like the Nigerian prince to remarkably close to the real thing, like the callcentre that rang me pretending to sell phone contract upgrades that used exactly the same crap phone sales techniques my actual network used when they (coincidentally) called me a week later, and had a 1-letter different email address with the URL redirecting to the same website

11thEarlOfMar 6y ago

One that was successful at my company recently was an e-mail sent to an electrical engineer from the CEO saying that the CEO needed a gift card from Target for an employee birthday, and had forgotten to pick it up. The EE went to Target and bought the card. The instructions including to reply to the e-mail with the card # so the CEO could include the number in the birthday card and not need the actual plastic. The spoof was believable at first glance. It used the CEOs actual first name and obscured the actual source e-mail address with his company e-mail as the name. What should have given the engineer pause (among other things) was the context. There was no reason that the CEO would ask an engineer to do this task at my company. Nonetheless, the engineer was perhaps overly deferential to the chain of command and the suspicion didn't emerge until he had embarrassed himself.

Aeolun 6y ago
Hah, I almost fell for the same thing, but when they asked for 4! $1000 codes! over email! I got a bit suspicious. Could have probably gotten 4 times $50 out of me though.
pwillia7 6y ago
That's rough. I got a phishing email from my CEO asking about something similar with money and had a brief 'oh shit' chain of command moment before my incredulousness kicked in. I get it.
mlang23 6y ago
Simple. Either call or reply asking him why he didn't send this mail to the secretary. If you can't be so direct with your boss, find another job.
- 11thEarlOfMar 6y ago
  In this case, it was his boss's boss's boss (I am his boss's boss). This particular engineer is highly valued at the company, including by me personally. It was at the same time surprising, but paining to see his consternation, and I certainly do hope he doesn't leave us. I'll gladly endure a $100 mistake to have his talents and attitude as an engineer.

spoonjim 6y ago

No offense, but you’re likely a “nobody.” So you’ve only come across the generic scams. This is a famous person. The phishing attempt was designed specifically for her. You don’t know if you’d fall for it because 1) nobody would invest that much effort into phishing you, and 2) “we’d like you to come teach at our university” is a plausible thing for her to hear but not you or I.

reddog 6y ago

> I have yet to see a scam which would fool me Maybe not but you will. If you live long enough you will suffer inevitable cognitive decline until one day you will be vulnerable to such a scam. We all will. No amount of good diet, meditation, fish oil and exercise will keep that from happening.

alisonkisk 6y ago
mlang23 has commented about being blind, which is a pretty huge filter against Internet scams, which aren't designed for screen readers.
- mlang23 6y ago
  You pretty much nailed it. I am filtering a lot of stuff because I refuse to use certain modern flashy technologies. Office 365, yeah, go away. Firefox? Only on a dedicated machine if I really need it. Emacs, SSH, tmux, old fashioned email (text only) and a linux virtual console is all I need to be productive, fast and especially happy. A big part of what makes these attacks work is the tech stack in use on the recipients side. I recently heard about a Emotet attack, and was told "Well, you know, the problem is that Outlook only shows the name but not the address by default". Oh well, what can you say about that?
  - Frondo 6y ago
    If any sizeable portion of internet users were also visually impaired, and on a stack similar to yours, you'd certainly see scams targeted at you. Good for you for being so far off the map, though, that is a good protective measure.
mlang23 6y ago
We're all gonna die. Some earlier, some later.