3 ms·
Ask HN: Could spam lists be improved with consideration of domain age?
Dear HN,
due to some successful phishing attempts at my scientific research organization with over 2k personnel, we've been blacklisted by Microsoft, which causes valid e-mails to their domains being rejected. This is a substantial problem, because it prevents a lot of scientists (and administration) from being able to efficiently communicate over the mailing-lists, and the like.
Our ticket system is still been flooded about this and although it is not my responsibility, I wanted to ask: why is it so easy for a three-letter domain, that's been online since the dawn of the Internet to get blacklisted so easily? Even a simple WHOIS request yields a "Changed" record stating 2017. Is the rejection list based on IPs? Is there anything preventing the usage of a more differentiating algorythm?
The respective requests to fix the problem have been sent, but it's been at least a week already and the havoc is real.
Please feel free to share your thoughts. Thank you!
- PaulHoule 5y agoPhishing = Death We are on the cusp of a cyber reaction to ransomware and similar threats that will change our technological and social basis as drastically as Vladimir Lenin or Jesus Christ. Simply we can not go on as a computer-using society with the lax way we've been doing things. There will never be another "September 11" because passengers will liquify anyone who tries to breach the cockpit. Someday we will look at cyber the same. Two years ago deadly dangerous actions such as "my bank authorizes a spam email from a third party" were not taken seriously at all. (Is it even safe for me to click unsubscribe?) Now the security team at by bank really listens and in two years I think somebody who authorized such an email will be fired immediately.
- pruepp 5y agoReminds me of that time when I discovered encrypted spreadsheets on the network file system at my previous employer (a small company then) one late afternoon. I still remember vividly our CTO walking in 10 minutes later, saying he thinks our newest backups are three months old. I went home that day thinking if the company will even exist tomorrow. The tendency for more regulation in the cyber is definitely there. I just have to wonder how it will play out between the poles of the process of security and convenience. We do have proactive measures against phishing and spam in-house, but as long as there is layer 8 of the OSI model involved, it will stay challenging, I guess ;)
- PaulHoule 5y agoIt is not regulation we need but a sea change in values. Like if somebody is sending senseless spam that gives evil a place to hide then they should be liquified, their business liquidated, and the resources reallocated to responsive organizations that know what time it is. Not by the law, but people voting with their feet.
- pruepp 5y agoI'm all for grassroots/direct action, especially in extreme situations like protecting the cockpit of the airplane, but this is what I was getting at, when I mentioned our proactive in-house measures: people almost always rely on separation of labour, in this case executive power, to do the policing, no? Any change in this area would require at least a generation of kids being taught basic IT-sec along with the usage of office programs in schools and training programs in the workforces at a massive scale. If this is the type of paradigm shift you're talking about, then I don't see it coming any time soon, unfortunately.
- gus_massa 5y agoWe had (have?) the same problem in my University. Our problem is that we have like 40.000 new students each year, so a simple "This is your new virtual campus. Please confirm your account and update your password." will raise a lot of red flags. The main problem is that the emails don't bounce, nor go to the spam folder. They just disappear in the air. If the other person had send an email to you, then the messages usually are delivered. So in our case it's not so bad for old connections.
- pruepp 5y agoThanks, I appreciate your story, because it made me realize, that in our case the e-mails do actually bounce, at least partially. 40k a year is massive in my eyes. I feel like there needs to be a global allow list for educational/scientific/infrastructural orgs, that would always make spamming cases involving them sorted out for manual processing, instead of piping them into the basic if-spam-then-block algo. At the end of the day getting locked out like that is just bad service for everyone involved.
- gus_massa 5y agoIt's distributed in 10-15 buildings, so you don't realize the size until you must to print the midterm for all[1] of them. [1] Actually a big subset of them that has a math course in the fist year.
- pruepp 5y agoThat is impressive, I have to wonder how much autonomy the suborgs (faculties?) have, because how many students do you have in total, then? 160k-ish?! Getting blacklisted on that scale sounds akin to one side of a road between a town (i.e. campus) and a megapolis getting blown-up.
- gus_massa 5y agoWikipedia says "enrolls more than 328,000 students" https://en.wikipedia.org/wiki/University_of_Buenos_Aires https://en.wikipedia.org/wiki/University_of_Buenos_Aires . It's split in 13+1 faculties, and many other smaller entities (that sometimes are not so small). Each part is quite independent. I work in the +1 part, that is a "common" first year for all the students, but it actually has like 10 "flavors" [1] (The first year of Medicine is equal to the first year Odontology, but it's different of the first year of Law School.) The emails block is probably not so coarse, and is probably split in a cases for each faculty. (I don't have hard data, just guessing, and comparing the information from the 2-3 cases I know.) And it may be even cases where it's applied to smaller groups, because many of the departments in each universities run their own web and email servers. [1] The "flavors" don't have an official name, I just made up a name here.