5 ms·
I suppose it could have been worse. I appreciate that they made the emails very clearly fake. The fact it passed DKIM checks was definitely alarming, though. A
by junon 5y ago
I suppose it could have been worse. I appreciate that they made the emails very clearly fake. The fact it passed DKIM checks was definitely alarming, though. A lot of people thought there was a flaw in DKIM somehow, but unsurprisingly it's a flaw with the FBI's site.
All in good fun, I suppose.
- brightball 5y agoA ton of people don’t ever rotate their DKIM keys. If you’re not using email tooling that handles it automatically on a regular basis it’s an easy thing to do since it doesn’t expire like an SSL cert. Anybody gets their hands on the private key, ex employee, compromised via hack, etc then everything will sail through.
- windexh8er 5y agoYou may enjoy this (I believe it was on HN last year): "DKIM: Show Your Privates" [0]. [0] https://rya.nc/dkim-privates.html https://rya.nc/dkim-privates.html
- brightball 5y agoI remember it! Solid points all around.
- s5300 5y agoI'll never forgive the Twitter large accounts hacker for not choosing literally anything funny & instead tweeting a dumb "gibs me Bitcoin" Could've been the funniest thing the internet had seen in years, & will likely not happen at that scale again for quite some time.
- tgsovlerkhgsel 5y agoI'm surprised that the FBI hacker didn't use it for some for-profit fraud scheme.
- FDSGSG 5y ago>A lot of people thought there was a flaw in DKIM somehow [Citation needed]
- gjs278 5y agoindeed. literally nobody said this
- exikyut 5y agoWell if you're going to wake up Deus Ex Machina and make it look stupid, it's probably your survival instincts suggesting you add just a dash of "task failed successfully" lest you find out what happens if you're successful, or worse, very successful. Letterhead and perfect graphics and absolutely perfect text and whatnot? You could send mail literally anywhere. Media. White House. Obscure government... stuff/facilities. International contacts...? FVEY? Infinite rabbithole much. SO MANY social engineering possibilities, like this is absolutely mad. And then... and then you're on the run for the rest of your life - not only against someone who can have you added to all the nonexistent facial recognition databases, but against unimpressed individuals who will specially go out of their way to find you regardless of where you are. Alternatively, you can pop the balloon in a way that's very obviously stupid, make absolutely no demonstrative points about social engineering in the process, and leverage everyone's collective panic attack to ensure there's a widespread search for the sending email address that would be much more far-reaching than a news article ever would. Genius.
- someotherperson 5y ago> And then... and then you're on the run for the rest of your life US government entities, like any other entity, aren’t superhuman. Taking basic steps to protect and anonymise yourself would be sufficient.
- exikyut 5y agoBut what can close the loop there is a patriotic sense of not on my lawn, for want of a better way to put it. "Vendetta" almost seems too strong a word, but maybe in some situations it wouldn't be. Basically the kind of mindset that can drive long-term focus/fixation. That's scary, tbh.
- legulere 5y agoThey have a lot of resources though and it's very hard to not leave any trace behind.
- someotherperson 5y ago