6 ms·

Beyond having hardware keys, this scenario is why I really try to drive home, in all of my security trainings, the idea that you should instantly short circuit

Beyond having hardware keys, this scenario is why I really try to drive home, in all of my security trainings, the idea that you should instantly short circuit any situation where you receive a phone call (or other message) and someone starts asking for information. It's always okay to say, "actually, let me get back to you in a minute" and hang up, calling back on a known phone number from the employee directory, or communicate on different channel altogether. Organizationally, everyone should be prepared for and encourage that kind of response as well, such that employees are never scared to say it because they're worried about a snarky/angry/aggressive response. This also applies to non-work related calls: someone from your credit card company is calling and asking for something? Call back on the number on the back of your card.

hinkley 3y ago
Advice I haven't even followed myself: It's probably a good idea to program your bank's fraud number into your phone. The odds that someone hacks your bank's Contact Us page are small but not zero. The bedrock of both PGP and .ssh/known_hosts could be restated as, "get information before anyone knows you need it". Fraud departments contacting me about potentially fraudulent charges is always going to make me upset. Jury is still out on whether it will always trigger a rant, but the prognosis is not good.
- GauntletWizard 3y ago
  At least once I have gotten a terribly phrased and link-strewn "Fraud Alert" from a bank, reported it to said bank's anti-phisihing e-mail address, gotten a personalized mail that responded that it was in fact fraud and that they had policies against using third party subdomains like... And then found out the day later that yes, that was their real new anti-fraud tool and template. There will need to be jail time for the idiots writing the government standards on these fraud departments before we get jail time for the idiots running these fraud departments before it gets better.
  - hinkley 3y ago
    Last time I talked to someone about this they pointed out that fraud depts are often outsourced. Which is a lovely plan because now your customers hate you for something an entirely different company did to them. And also they are directing you away from the official website every single time you interact with them. I'm not sure what grounds you issue arrest warrants on, but I appreciate the sentiment.
    - GauntletWizard 3y ago
      Ironically, fraud. They have done substantial financial and "real" harm by pretending to be competent at things that they are clearly not, and have been a combination of remiss in their duties and complicit in the crimes of fraudsters. Sufficiently advanced incompetence is indistinguishable from malice, and should be prosecuted as such.
      - hinkley 3y ago
        Years ago I bought a tv. Clear on the other side of town. When I got home I had a message from the fraud dept about charges. I called them up to explain I did in fact buy that tv. They weren’t calling about the TV. They were calling about the car wash I stopped to get near my old neighborhood on the way home. For $8. Wat. And for a while they would flag me every time I went on a road trip or travelled, because they pegged me as a non traveler. I travel, but quality over quantity. And you’re basically psychologically fencing me into a profile you’ve written about me that’s wrong by punishing me every time I step out of it? Fuck you.
dataflow 3y ago
> this scenario is why I really try to drive home, in all of my security trainings, the idea that you should instantly short circuit any situation where you receive a phone call (or other message) and someone starts asking for information. The trouble is, calling the number on the back of your card requires actually taking out your card, dialing it, wading through a million menus, and waiting who-knows-how-long for someone to pick up, and hoping you're not reaching a number that'll make you go through fifteen transfers to get to the right agent. People have stuff to do, they don't want to wait around with one hand occupied waiting for a phone call to get picked up for fifteen minutes. When the alternative is just telling your information on the phone... it's only natural that people do it. Of course it's horrible for security, I'm not saying anyone should just give information on the phone. But the reality is that people will do it anyway, because the cost of the alternative isn't necessarily negligible.
- josho 3y ago
  Great point. But it could be easily solved with something like: “Call the number on the back of your credit card. Push *5 and when prompted enter your credit card number and you will be immediately connected back to my line”
  - dataflow 3y ago
    Or just connect you directly if you call back within a few minutes from the same number they called, no need to press anything. But I guess that's too advanced for 2023 technology
- macNchz 3y ago
  I don't think most people who get scammed this way pause to say "oh, this might be someone stealing my credit card number", then disregard that thought because it's too much of a pain to call back on an official line. Instead I think they don't question the situation at all, or the scammer has enough information to sound sufficiently authoritative. Most non-technical people I've talked to about this are pretty scared of getting scammed, but tell me the thought never crossed their mind they could call back on a trusted number. I like the "hang up, call back" approach because it takes individual judgment out of the equation: you're not trying to evaluate in real time whether the call is legit, or whether whatever you're being asked to share is actually sensitive. That's the vulnerable area in our brains that scammers exploit.
tyingq 3y ago
>This also applies to non-work related calls: someone from your credit card company is calling and asking for something? Call back on the number on the back of your card. There's a number of situations, not just credit card ones, where it's impossible or remarkably difficult to get back to the person that had the context of why they were calling. Your advice holds, of course, because it's better to not be phished. But sometimes it means losing that conversation.
- macNchz 3y ago
  Definitely, sometimes they'll have a case number or agent id you can use to get back to them, but there are cases where you have to assume if it's important to them they'll continue to nag or reach out on another channel. I have had at least one situation where I spent a while trying to get back to a quite convincing/legitimate sounding caller this way, where, as I escalated through support people it became increasingly clear that the initial call had been a high quality scam, and not in fact a real person from the bank.
  - codebje 3y ago
    I put in very limited effort in returning cold calls. The contact is being initiated by the other party, the interest in the exchange is theirs, and the onus on making it work is theirs. Companies, including banks, don't call you to protect _your_ interests, they call you to protect themselves.
    - BenjiWiebe 3y ago
      Except some banks and credit card companies will call you to notify you of fraud on your account.
- munk-a 3y ago
  My mother recently started having to deal directly with utility bills and the like and this was some information we impressed very early on. You should never agree to billing or hand over CC/account information in a phone call you didn't initiate. She hasn't run into an issue yet - most utilities, online stores and other entities have call in numbers if you need to resolve a billing dispute. That random company you bought a plumbing valve from has an office somewhere with a secretary that gets a phone call maybe three times a month from customers looking to resolve issues - and Amazon has mostly centralized support for small sellers and has lines you can call to resolve any disputes you have which may forward you to the original sale party but often just resolve the issue directly. Honestly, the worst experiences are usually with large companies that funnel all customers into massive phone centers - I've probably lost the better part of a week to Comcast over my lifetime.
hn_throwaway_99 3y ago
Amen, amen, amen. IMO "Hang up, look up, call back" should basically be the only thing that security training focuses on, and it should be culturally ingrained: https://krebsonsecurity.com/2020/04/when-in-doubt-hang-up-look-up-call-back/ https://krebsonsecurity.com/2020/04/when-in-doubt-hang-up-lo...
codebje 3y ago
I've had a wide range of responses from people calling me when I tell them I won't give personal details out based on a cold call. A few understand immediately and are good about it. Most have absolutely no idea why I would even be bothered about an unexpected caller asking me for personal information. A few are practically hostile about it. None, to date, have worked for a company that has a process established for safely establishing identity of the person they're calling. None. Lengthy on-hold queues, a different person with no context, or a process that can't be suspended and resumed so the person answering the phone has no idea why I got a call in the first place. (Yet I'll frequently get email full of information that wouldn't be given out over the phone, unencrypted, unsigned, and without any verification that the person reading it is really me.) The organisational change required here is with the callers rather than the callees, and since it's completely about protecting the consumer rather than the vendor, it's a change that's unlikely to happen without regulation.
- Terretta 3y ago
  > None, to date, have worked for a company that has a process established for safely establishing identity of the person they're calling What's fun here is, the moment they ask you for anything, flip the script and start to try to establish a trust identity for the caller. Tell them you need to verify them, and then ask how they propose you do that. Choose your own adventure from there.
  - nanidin 3y ago
    Credit card fraud departments are generally good about this.
    - raverbashing 3y ago
      Are they? Are they still asking about "mother's maiden name"?!
    - SoftTalker 3y ago
      I can't remember which company it was, but I got a call a few years ago about some issue with an account, and they wanted some information to "verify my identity" I said wait a minute, you called me. Shouldn't I be verifying who you are? The guy kind of laughed and said yeah, but this is the process I've been given to follow. I said I would call back on public customer service number and he said that would be fine. It turned out it was a legit call, but just weird that they would operate that way. I wish I could remember who it was. A credit card, I think.
rmbyrro 3y ago
> someone starts asking for information Especially OTP codes. I can't understand how someone works at a tech company and is clueless to the point of sharing an auth code over the phone. My grandma, sure, but a Retool employee? C'mon, haven't we all read enough of these stories?
- ketzo 3y ago
  You can't understand at all how someone with your coworker's voice might lull you into a false sense of urgency and safety? Security is a weak-link problem, not a strong-link one. You have to plan for the least security-minded people, the tired and stressed employee.
  - deleted 3y ago
    [deleted]
  - rmbyrro 3y ago
    I can understand how someone with my coworker's voice might lull myself into a false sense of urgency and safety. To the point of sharing an OTP code over the phone from a strange number? I'm sorry, no.
    - SoftTalker 3y ago
      You could give them a false number and see what happens. That might trip up their script enough to reveal they aren't who they seem to be. Just play dumb -- "I can't understand why it's not working, that's the number on my phone...."
      - rmbyrro 3y ago
        That's also a good idea.
    - matsemann 3y ago
      They could trivially spoof the number they're calling from to match.
dspillett 3y ago
> the idea that you should instantly short circuit any situation where you receive a phone call (or other message) and someone starts asking for information It really irritates me that some significant companies openly encourage customers to ignore this advice, teaching then had practise. The most recent case I know of is PayPal calling myself. It was actually thenm new cc account, I thought I'd setup auto payment but it wasn't so I was a child if days late with the first payment) but it so easily could have not been. The person on the other end seemed rather taken aback that I wouldn't discuss my account or confirm any details on a call I'd not started, and all but insisted that I couldn't hang up and call back. In the end I just said I was hanging up and if I couldn't call back than that was a them problem because at that point I had no way of telling if it was really the company or not. At that point she said she'd send a message that is could read via my account online, which did actually happen so it wasn't a scammer. But to encourage customers to perform unsafe behaviour with personal and account details is highly irresponsible.
lxgr 3y ago
> someone from your credit card company is calling and asking for something? Call back on the number on the back of your card. This recently happened to me, and bizarrely they wouldn’t tell me what’s actually going on on my account because of not being able to verify me. (They were also immediately asking for personal information on the outbound call, which apparently really was from them.)
- polygamous_bat 3y ago
  That's the big problem, isn't it? People think it's okay to give out information on an incoming call because often it is really okay. If it were unreliable 99% of the time, phishers would not use this method as an attack vector.
- OJFord 3y ago
  Financial companies, the government, ... I always try to bother to raise the issue afterwards, but (not that I think my comments alone would do anything) so far nothing changed that I've taken issue with, I don't think. A big one I'm aware of many others complaining about in the industry is local governments in the UK soliciting elector details via 'householdresponse.com/<councilname>' in a completely indistinguishable from phishing sort of way. (They send you a single letter directing you to that address with 'security code part 1' and '2' in the same letter, along with inherently your postcode which is the only other identifier requested. It's an awful combination of security theatre and miseducation that scammy phishing techniques look legit.)
  - shortcake27 3y ago
    Ha, this reminds me of driver licences in Australia. So at this point almost everyones licence has been leaked multiple times (and just having the details used to be enough to open a bank account online, not sure if this is still the case). I received an email from my state’s RTA, saying they were adding 2-factor authentication to licences. Great! I assumed this might be an oauth type scenario, or maybe even just email. Nope. The “second” factor is a different number printed on the licence. Surely this communication had to go through multiple departments, get vetted for accuracy. Yet no one picked up that this isn’t multi factor authentication. Its only purpose is to make it easier for them to issue a new licence _after_ you’ve been defrauded out of all your money, because most states refuse to issue people with new licence numbers. It does nothing more than fix an incompetence in their system/process. Yet it was marketed as some kind of security breakthrough, as if it would add protection to your licence.
RulerOf 3y ago
> any situation where you receive a phone call (or other message) and someone starts asking for information. I had AWS of all places do this to me a year or two ago. The rep needed me to confirm some piece of information in order to talk to me about an ongoing issue with the account. If I recall correctly, the rep wanted a nonce that had been emailed to me. "I'm terribly sorry but I won't do that. You called me." Ultimately turned out to be legit, but I admit I was floored.
itsoktocry 3y ago
>This also applies to non-work related calls: someone from your credit card company is calling and asking for something? Call back on the number on the back of your card. This is a policy I've implemented as well, both for myself and loved ones: don't provide any information to unverified incoming calls. Zero. Sometimes I'll get some kind of sales call, which I may even be interested in. I'll say, proceed with the pitch to which they'll reply "first we need to confirm your identify". Then I refuse: you called me. Why do you need me to provide private information to confirm my identity?
- raybb 3y ago
  What does unverified mean in this case?
quickthrower2 3y ago
This is where some kind of chaos monkey might be good. Imagine something that randomly slacks from one human account to another asking for passwords and then the receiver has to press a "suspect message" button as a form of ongoing awareness training. As part of that a genuine ask for a password would get the same response, and perhaps the button sends a nice message like "Looks like you have asked for a password. We get it, sometimes you need to get the job done, but please try to avoid this as it can make us insecure. Please read our security policy document here."
raverbashing 3y ago
True, why are people so eager to pick up the phone. The millenials are right in not picking up the phone
karussell 3y ago
What vendors for hardware keys would be recommended besides yubico?
xnx 3y ago
I've expanded this to the general case and don't answer phone calls.
- hackeraccount 3y ago
  I've stopped listening to people. I limit myself to talking at them. The upside is that I'm never fooled. The downside is that so far as I can tell half the world hates me and the other half think I'm a lunatic.

hinkley 3y ago

Advice I haven't even followed myself: It's probably a good idea to program your bank's fraud number into your phone. The odds that someone hacks your bank's Contact Us page are small but not zero. The bedrock of both PGP and .ssh/known_hosts could be restated as, "get information before anyone knows you need it". Fraud departments contacting me about potentially fraudulent charges is always going to make me upset. Jury is still out on whether it will always trigger a rant, but the prognosis is not good.

GauntletWizard 3y ago
At least once I have gotten a terribly phrased and link-strewn "Fraud Alert" from a bank, reported it to said bank's anti-phisihing e-mail address, gotten a personalized mail that responded that it was in fact fraud and that they had policies against using third party subdomains like... And then found out the day later that yes, that was their real new anti-fraud tool and template. There will need to be jail time for the idiots writing the government standards on these fraud departments before we get jail time for the idiots running these fraud departments before it gets better.
- hinkley 3y ago
  Last time I talked to someone about this they pointed out that fraud depts are often outsourced. Which is a lovely plan because now your customers hate you for something an entirely different company did to them. And also they are directing you away from the official website every single time you interact with them. I'm not sure what grounds you issue arrest warrants on, but I appreciate the sentiment.
  - GauntletWizard 3y ago
    Ironically, fraud. They have done substantial financial and "real" harm by pretending to be competent at things that they are clearly not, and have been a combination of remiss in their duties and complicit in the crimes of fraudsters. Sufficiently advanced incompetence is indistinguishable from malice, and should be prosecuted as such.
    - hinkley 3y ago
      Years ago I bought a tv. Clear on the other side of town. When I got home I had a message from the fraud dept about charges. I called them up to explain I did in fact buy that tv. They weren’t calling about the TV. They were calling about the car wash I stopped to get near my old neighborhood on the way home. For $8. Wat. And for a while they would flag me every time I went on a road trip or travelled, because they pegged me as a non traveler. I travel, but quality over quantity. And you’re basically psychologically fencing me into a profile you’ve written about me that’s wrong by punishing me every time I step out of it? Fuck you.

dataflow 3y ago

> this scenario is why I really try to drive home, in all of my security trainings, the idea that you should instantly short circuit any situation where you receive a phone call (or other message) and someone starts asking for information. The trouble is, calling the number on the back of your card requires actually taking out your card, dialing it, wading through a million menus, and waiting who-knows-how-long for someone to pick up, and hoping you're not reaching a number that'll make you go through fifteen transfers to get to the right agent. People have stuff to do, they don't want to wait around with one hand occupied waiting for a phone call to get picked up for fifteen minutes. When the alternative is just telling your information on the phone... it's only natural that people do it. Of course it's horrible for security, I'm not saying anyone should just give information on the phone. But the reality is that people will do it anyway, because the cost of the alternative isn't necessarily negligible.

josho 3y ago
Great point. But it could be easily solved with something like: “Call the number on the back of your credit card. Push *5 and when prompted enter your credit card number and you will be immediately connected back to my line”
- dataflow 3y ago
  Or just connect you directly if you call back within a few minutes from the same number they called, no need to press anything. But I guess that's too advanced for 2023 technology
macNchz 3y ago
I don't think most people who get scammed this way pause to say "oh, this might be someone stealing my credit card number", then disregard that thought because it's too much of a pain to call back on an official line. Instead I think they don't question the situation at all, or the scammer has enough information to sound sufficiently authoritative. Most non-technical people I've talked to about this are pretty scared of getting scammed, but tell me the thought never crossed their mind they could call back on a trusted number. I like the "hang up, call back" approach because it takes individual judgment out of the equation: you're not trying to evaluate in real time whether the call is legit, or whether whatever you're being asked to share is actually sensitive. That's the vulnerable area in our brains that scammers exploit.

tyingq 3y ago

>This also applies to non-work related calls: someone from your credit card company is calling and asking for something? Call back on the number on the back of your card. There's a number of situations, not just credit card ones, where it's impossible or remarkably difficult to get back to the person that had the context of why they were calling. Your advice holds, of course, because it's better to not be phished. But sometimes it means losing that conversation.

macNchz 3y ago
Definitely, sometimes they'll have a case number or agent id you can use to get back to them, but there are cases where you have to assume if it's important to them they'll continue to nag or reach out on another channel. I have had at least one situation where I spent a while trying to get back to a quite convincing/legitimate sounding caller this way, where, as I escalated through support people it became increasingly clear that the initial call had been a high quality scam, and not in fact a real person from the bank.
- codebje 3y ago
  I put in very limited effort in returning cold calls. The contact is being initiated by the other party, the interest in the exchange is theirs, and the onus on making it work is theirs. Companies, including banks, don't call you to protect _your_ interests, they call you to protect themselves.
  - BenjiWiebe 3y ago
    Except some banks and credit card companies will call you to notify you of fraud on your account.
munk-a 3y ago
My mother recently started having to deal directly with utility bills and the like and this was some information we impressed very early on. You should never agree to billing or hand over CC/account information in a phone call you didn't initiate. She hasn't run into an issue yet - most utilities, online stores and other entities have call in numbers if you need to resolve a billing dispute. That random company you bought a plumbing valve from has an office somewhere with a secretary that gets a phone call maybe three times a month from customers looking to resolve issues - and Amazon has mostly centralized support for small sellers and has lines you can call to resolve any disputes you have which may forward you to the original sale party but often just resolve the issue directly. Honestly, the worst experiences are usually with large companies that funnel all customers into massive phone centers - I've probably lost the better part of a week to Comcast over my lifetime.

hn_throwaway_99 3y ago

Amen, amen, amen. IMO "Hang up, look up, call back" should basically be the only thing that security training focuses on, and it should be culturally ingrained: https://krebsonsecurity.com/2020/04/when-in-doubt-hang-up-look-up-call-back/ https://krebsonsecurity.com/2020/04/when-in-doubt-hang-up-lo...

codebje 3y ago

I've had a wide range of responses from people calling me when I tell them I won't give personal details out based on a cold call. A few understand immediately and are good about it. Most have absolutely no idea why I would even be bothered about an unexpected caller asking me for personal information. A few are practically hostile about it. None, to date, have worked for a company that has a process established for safely establishing identity of the person they're calling. None. Lengthy on-hold queues, a different person with no context, or a process that can't be suspended and resumed so the person answering the phone has no idea why I got a call in the first place. (Yet I'll frequently get email full of information that wouldn't be given out over the phone, unencrypted, unsigned, and without any verification that the person reading it is really me.) The organisational change required here is with the callers rather than the callees, and since it's completely about protecting the consumer rather than the vendor, it's a change that's unlikely to happen without regulation.

Terretta 3y ago
> None, to date, have worked for a company that has a process established for safely establishing identity of the person they're calling What's fun here is, the moment they ask you for anything, flip the script and start to try to establish a trust identity for the caller. Tell them you need to verify them, and then ask how they propose you do that. Choose your own adventure from there.
- nanidin 3y ago
  Credit card fraud departments are generally good about this.
  - raverbashing 3y ago
    Are they? Are they still asking about "mother's maiden name"?!
  - SoftTalker 3y ago
    I can't remember which company it was, but I got a call a few years ago about some issue with an account, and they wanted some information to "verify my identity" I said wait a minute, you called me. Shouldn't I be verifying who you are? The guy kind of laughed and said yeah, but this is the process I've been given to follow. I said I would call back on public customer service number and he said that would be fine. It turned out it was a legit call, but just weird that they would operate that way. I wish I could remember who it was. A credit card, I think.

rmbyrro 3y ago

> someone starts asking for information Especially OTP codes. I can't understand how someone works at a tech company and is clueless to the point of sharing an auth code over the phone. My grandma, sure, but a Retool employee? C'mon, haven't we all read enough of these stories?

ketzo 3y ago
You can't understand at all how someone with your coworker's voice might lull you into a false sense of urgency and safety? Security is a weak-link problem, not a strong-link one. You have to plan for the least security-minded people, the tired and stressed employee.
- deleted 3y ago
  [deleted]
- rmbyrro 3y ago
  I can understand how someone with my coworker's voice might lull myself into a false sense of urgency and safety. To the point of sharing an OTP code over the phone from a strange number? I'm sorry, no.
  - SoftTalker 3y ago
    You could give them a false number and see what happens. That might trip up their script enough to reveal they aren't who they seem to be. Just play dumb -- "I can't understand why it's not working, that's the number on my phone...."
    - rmbyrro 3y ago
      That's also a good idea.
  - matsemann 3y ago
    They could trivially spoof the number they're calling from to match.

dspillett 3y ago

> the idea that you should instantly short circuit any situation where you receive a phone call (or other message) and someone starts asking for information It really irritates me that some significant companies openly encourage customers to ignore this advice, teaching then had practise. The most recent case I know of is PayPal calling myself. It was actually thenm new cc account, I thought I'd setup auto payment but it wasn't so I was a child if days late with the first payment) but it so easily could have not been. The person on the other end seemed rather taken aback that I wouldn't discuss my account or confirm any details on a call I'd not started, and all but insisted that I couldn't hang up and call back. In the end I just said I was hanging up and if I couldn't call back than that was a them problem because at that point I had no way of telling if it was really the company or not. At that point she said she'd send a message that is could read via my account online, which did actually happen so it wasn't a scammer. But to encourage customers to perform unsafe behaviour with personal and account details is highly irresponsible.

lxgr 3y ago

> someone from your credit card company is calling and asking for something? Call back on the number on the back of your card. This recently happened to me, and bizarrely they wouldn’t tell me what’s actually going on on my account because of not being able to verify me. (They were also immediately asking for personal information on the outbound call, which apparently really was from them.)

polygamous_bat 3y ago
That's the big problem, isn't it? People think it's okay to give out information on an incoming call because often it is really okay. If it were unreliable 99% of the time, phishers would not use this method as an attack vector.
OJFord 3y ago
Financial companies, the government, ... I always try to bother to raise the issue afterwards, but (not that I think my comments alone would do anything) so far nothing changed that I've taken issue with, I don't think. A big one I'm aware of many others complaining about in the industry is local governments in the UK soliciting elector details via 'householdresponse.com/<councilname>' in a completely indistinguishable from phishing sort of way. (They send you a single letter directing you to that address with 'security code part 1' and '2' in the same letter, along with inherently your postcode which is the only other identifier requested. It's an awful combination of security theatre and miseducation that scammy phishing techniques look legit.)
- shortcake27 3y ago
  Ha, this reminds me of driver licences in Australia. So at this point almost everyones licence has been leaked multiple times (and just having the details used to be enough to open a bank account online, not sure if this is still the case). I received an email from my state’s RTA, saying they were adding 2-factor authentication to licences. Great! I assumed this might be an oauth type scenario, or maybe even just email. Nope. The “second” factor is a different number printed on the licence. Surely this communication had to go through multiple departments, get vetted for accuracy. Yet no one picked up that this isn’t multi factor authentication. Its only purpose is to make it easier for them to issue a new licence _after_ you’ve been defrauded out of all your money, because most states refuse to issue people with new licence numbers. It does nothing more than fix an incompetence in their system/process. Yet it was marketed as some kind of security breakthrough, as if it would add protection to your licence.

RulerOf 3y ago

> any situation where you receive a phone call (or other message) and someone starts asking for information. I had AWS of all places do this to me a year or two ago. The rep needed me to confirm some piece of information in order to talk to me about an ongoing issue with the account. If I recall correctly, the rep wanted a nonce that had been emailed to me. "I'm terribly sorry but I won't do that. You called me." Ultimately turned out to be legit, but I admit I was floored.

itsoktocry 3y ago

>This also applies to non-work related calls: someone from your credit card company is calling and asking for something? Call back on the number on the back of your card. This is a policy I've implemented as well, both for myself and loved ones: don't provide any information to unverified incoming calls. Zero. Sometimes I'll get some kind of sales call, which I may even be interested in. I'll say, proceed with the pitch to which they'll reply "first we need to confirm your identify". Then I refuse: you called me. Why do you need me to provide private information to confirm my identity?

raybb 3y ago
What does unverified mean in this case?

quickthrower2 3y ago

This is where some kind of chaos monkey might be good. Imagine something that randomly slacks from one human account to another asking for passwords and then the receiver has to press a "suspect message" button as a form of ongoing awareness training. As part of that a genuine ask for a password would get the same response, and perhaps the button sends a nice message like "Looks like you have asked for a password. We get it, sometimes you need to get the job done, but please try to avoid this as it can make us insecure. Please read our security policy document here."

raverbashing 3y ago

True, why are people so eager to pick up the phone. The millenials are right in not picking up the phone

karussell 3y ago

What vendors for hardware keys would be recommended besides yubico?

xnx 3y ago

I've expanded this to the general case and don't answer phone calls.

hackeraccount 3y ago
I've stopped listening to people. I limit myself to talking at them. The upside is that I'm never fooled. The downside is that so far as I can tell half the world hates me and the other half think I'm a lunatic.