6 ms·

Would a non-savvy user realize "venmoforward@gmail.com" is not a reasonable source address for a message that otherwise looks like it comes from Venmo? I think

Would a non-savvy user realize "venmoforward@gmail.com" is not a reasonable source address for a message that otherwise looks like it comes from Venmo? I think the whole principle of "anyone who knows your email address / phone number can contact you" was already obsolete over 20 years ago. Access to my inbox and ringer should be by revocable invitation only.

mulmen 4y ago
I hate how hard Slack makes it to copy a damn username. I get messages from people and try to look them up in the corporate directory but at some point it is just easier to type it in.
- delecti 4y ago
  I don't know if there's an equivalent on other OSs, but in most browsers in Windows if you hold down Alt you can select text in an otherwise clickable link.
  - mulmen 4y ago
    Ctrl-click on a mac at least gives the option. But this is what I hate most about Slack specifically and Electron in general. It’s so obviously a web app shoved into what kinda looks like a native window. But all the behavior is webpagey, except not in my browser, which I already know how to use. Here’s a fun one: Click in the conversation history panel. Use your “select all” shortcut. Despair.
    - delecti 4y ago
      Why not just use the webpage? I've only ever used Slack (and Mattermost, which my work uses) in my browser, and I'm not sure what reasons there could be to install the app when it's just a less convenient container for the same content.
      - mulmen 4y ago
        I actually want a native app. Going to the web would be another step backwards.
  - paradoja 4y ago
    Verifying that it works in Firefox in Linux (with Gnome and with Sway, in case that matters). Thanks a lot for this!
masswerk 4y ago
I really doubt the basis of this argument. Arguably, there is something to be learned with any new technology and any expectation to the contrary may be rather illusionary. E.g., with the postal system, how do you know that Paris, Texas, is not Paris, France, when you ignore those "technical" bits like "Texas" and "France"? (But, when these were mentioned in conversation, you could infer this from context, but now, on the letter envelope, there's no such context provided at all!) Turns out, most people were able to cope with these "technical" challenges and some aspects of this were even taught in school (how to write an address). Most people are even able to memorize the ZIP codes most important to them. Arguably, email addresses are (much) simpler to parse than postal addresses (including thing's like c/o, post boxes, etc.)
- someweirdperson 4y ago
  > Arguably, email addresses are (much) simpler to parse than postal addresses (including thing's like c/o, post boxes, etc.) Both are equally easy to fake. The difference is sending fake bulk postal mail is much more expensive than email.
- alpaca128 4y ago
  There's a difference between that and correctly guessing that a specific address belongs to a scammer. Also fake letters from the IRS etc. are a thing and people still fall for it. Detecting scams like this is a skill and some people - like elderly or disabled people - just aren't good at it. It doesn't help that some legit businesses are officially using gmail/hotmail/whatever addresses.
  - masswerk 4y ago
    I'd say, 99.x% of the scam or fishing attempts I receive are easily detectable by the email address. E.g., a fairly accurate rendition of the bank CI, even with an appropriate text, an email clear name in accordance with the bank, but something like "<_petra167fghj@unknownserver.com>" as the email address. The problem being, it's exactly that part, which gives the scam away, that is hidden by the common email client.
autoexec 4y ago
> Would a non-savvy user realize "venmoforward@gmail.com" is not a reasonable source address for a message that otherwise looks like it comes from Venmo? Email campaigns from companies are a mess. Even the company I work for sends official emails out from addresses at numerous 3rd party domains each using different mail servers. They often go out with verbiage nearly identical to what I see in phishing emails. They've contained links that point to URL shorteners or some other random 3rd party site that we don't own with URLs full of unintelligible tracking info. I deal with phishing issues almost every day. Most of the time phishing emails are pretty obvious, but I've had customers ask me if an email claiming to come from the company I work for was legitimate and even after looking over the message and the headers I couldn't give a clear answer. I've had several talks with marketing about it, and I've managed to catch a few horrific communications before they went out, but they aren't willing to stop sending from or linking to third parties.
- Pulcinella 4y ago
  Even first party domains can be a problem if…uh…certain departments get a hold of the email address. I’ve definitely been I meetings that go something like: Developer: Does anyone know why helpdesk@company.com is being flagged as a spam address? All of our customers are saying our support emails are ending up in their spam folder. Marketing guy: Yeah does anyone know why our support and advertising emails are being marked as spam? Developer: …never mind.
  - kmeisthax 4y ago
    The documentation for Mailgun specifically asks you to send transactional and marketing e-mails from separate subdomains for precisely this reason. It still doesn't justify companymarketing.com and companyhelpdesk.com though.
navjack27 4y ago
Was that the old principal? The one I've always ascribed to was "if you didn't initiate the communication then don't respond to it"
tsimionescu 4y ago
Maybe, maybe not, but they still have a much better thane than when it comes from "Venmo Support".
donatzsky 4y ago
> Would a non-savvy user realize "venmoforward@gmail.com" is not a reasonable source address for a message that otherwise looks like it comes from Venmo? In many cases, no. They simply see that it has Venmo (or whatever) in it and assume it must be legit. I've tried to explain this exact thing a few times. Not even sure I managed to get them to understand that a big company wouldn't use Gmail, but rather their own domain.
- userbinator 4y ago
  If they know what Venmo's real address is, because presumably they would've already seen the real emails many times, then the sudden change of address could be noticed and arouse some suspicion. As it is, without that hint, they are even less likely to notice.

mulmen 4y ago

I hate how hard Slack makes it to copy a damn username. I get messages from people and try to look them up in the corporate directory but at some point it is just easier to type it in.

delecti 4y ago
I don't know if there's an equivalent on other OSs, but in most browsers in Windows if you hold down Alt you can select text in an otherwise clickable link.
- mulmen 4y ago
  Ctrl-click on a mac at least gives the option. But this is what I hate most about Slack specifically and Electron in general. It’s so obviously a web app shoved into what kinda looks like a native window. But all the behavior is webpagey, except not in my browser, which I already know how to use. Here’s a fun one: Click in the conversation history panel. Use your “select all” shortcut. Despair.
  - delecti 4y ago
    Why not just use the webpage? I've only ever used Slack (and Mattermost, which my work uses) in my browser, and I'm not sure what reasons there could be to install the app when it's just a less convenient container for the same content.
    - mulmen 4y ago
      I actually want a native app. Going to the web would be another step backwards.
- paradoja 4y ago
  Verifying that it works in Firefox in Linux (with Gnome and with Sway, in case that matters). Thanks a lot for this!

masswerk 4y ago

I really doubt the basis of this argument. Arguably, there is something to be learned with any new technology and any expectation to the contrary may be rather illusionary. E.g., with the postal system, how do you know that Paris, Texas, is not Paris, France, when you ignore those "technical" bits like "Texas" and "France"? (But, when these were mentioned in conversation, you could infer this from context, but now, on the letter envelope, there's no such context provided at all!) Turns out, most people were able to cope with these "technical" challenges and some aspects of this were even taught in school (how to write an address). Most people are even able to memorize the ZIP codes most important to them. Arguably, email addresses are (much) simpler to parse than postal addresses (including thing's like c/o, post boxes, etc.)

someweirdperson 4y ago
> Arguably, email addresses are (much) simpler to parse than postal addresses (including thing's like c/o, post boxes, etc.) Both are equally easy to fake. The difference is sending fake bulk postal mail is much more expensive than email.
alpaca128 4y ago
There's a difference between that and correctly guessing that a specific address belongs to a scammer. Also fake letters from the IRS etc. are a thing and people still fall for it. Detecting scams like this is a skill and some people - like elderly or disabled people - just aren't good at it. It doesn't help that some legit businesses are officially using gmail/hotmail/whatever addresses.
- masswerk 4y ago
  I'd say, 99.x% of the scam or fishing attempts I receive are easily detectable by the email address. E.g., a fairly accurate rendition of the bank CI, even with an appropriate text, an email clear name in accordance with the bank, but something like "<_petra167fghj@unknownserver.com>" as the email address. The problem being, it's exactly that part, which gives the scam away, that is hidden by the common email client.

autoexec 4y ago

> Would a non-savvy user realize "venmoforward@gmail.com" is not a reasonable source address for a message that otherwise looks like it comes from Venmo? Email campaigns from companies are a mess. Even the company I work for sends official emails out from addresses at numerous 3rd party domains each using different mail servers. They often go out with verbiage nearly identical to what I see in phishing emails. They've contained links that point to URL shorteners or some other random 3rd party site that we don't own with URLs full of unintelligible tracking info. I deal with phishing issues almost every day. Most of the time phishing emails are pretty obvious, but I've had customers ask me if an email claiming to come from the company I work for was legitimate and even after looking over the message and the headers I couldn't give a clear answer. I've had several talks with marketing about it, and I've managed to catch a few horrific communications before they went out, but they aren't willing to stop sending from or linking to third parties.

Pulcinella 4y ago
Even first party domains can be a problem if…uh…certain departments get a hold of the email address. I’ve definitely been I meetings that go something like: Developer: Does anyone know why helpdesk@company.com is being flagged as a spam address? All of our customers are saying our support emails are ending up in their spam folder. Marketing guy: Yeah does anyone know why our support and advertising emails are being marked as spam? Developer: …never mind.
- kmeisthax 4y ago
  The documentation for Mailgun specifically asks you to send transactional and marketing e-mails from separate subdomains for precisely this reason. It still doesn't justify companymarketing.com and companyhelpdesk.com though.

navjack27 4y ago

Was that the old principal? The one I've always ascribed to was "if you didn't initiate the communication then don't respond to it"

tsimionescu 4y ago

Maybe, maybe not, but they still have a much better thane than when it comes from "Venmo Support".

donatzsky 4y ago

> Would a non-savvy user realize "venmoforward@gmail.com" is not a reasonable source address for a message that otherwise looks like it comes from Venmo? In many cases, no. They simply see that it has Venmo (or whatever) in it and assume it must be legit. I've tried to explain this exact thing a few times. Not even sure I managed to get them to understand that a big company wouldn't use Gmail, but rather their own domain.

userbinator 4y ago
If they know what Venmo's real address is, because presumably they would've already seen the real emails many times, then the sudden change of address could be noticed and arouse some suspicion. As it is, without that hint, they are even less likely to notice.