8 ms·

So many of these scams start the same way: when the victim is contacted by a random person. Phones, email, social media, and postal mail tend to allow this by

So many of these scams start the same way: when the victim is contacted by a random person. Phones, email, social media, and postal mail tend to allow this by default (being contacted by a rando anywhere in the world). But maybe the default should be that users' inboxes and incoming "ports" on such services are locked down for the average user, such that only a few trusted senders, to whom the user has previously given access (maybe with a per-sender access code) can contact that user. Marketing and customer service departments, security researchers with honeypots, and adventurous individuals may want to leave such incoming "ports" open, but the average person probably doesn't need or want to have their communication network accessed or unwittingly expanded by others. They probably only want to communicate with their existing, trusted contacts and to be able to add new contacts organically, but don't really want or need to allow anyone to "slide into their DMs" without prior authorization from the recipient's end. (Special emergency protocols may be needed to allow verified, vetted incoming communication in the case of true emergencies, in order to give people the reassurance that they're not missing out by locking down their incoming "ports".) Communication technologies have made the world small and flat, but maybe we need to enlarge it and unflatten it unidirectionally, on the sender's (and scammer's) side. Some people already do this manually on their phones, by refusing to answer calls from random, unknown numbers. Maybe such defense measures should be enabled by default for the public at large, with the option of carefully and partially disabling them, if desired.

artursapek 3y ago
I like this line of thinking, but I think education is the key. Even with good filters you have to be able to smell bullshit. I enabled iOS “silence unknown callers” option as soon as they added it, but found I miss important calls sometimes. I rely on voicemail for those. There’s no way to completely whitelist your personal communications in this world. I do get scam voicemails and emails sometimes, but am good at detecting them.
- fortran77 3y ago
  > I like this line of thinking, but I think education is the key. My 90 year old mother gets less and less able to think clearly each passing month. She always is calling me telling me that "her computer is completely dead" and it takes my 10 minutes to realize it's just her mouse that's not working becasue she forgot to charge it. No amount of education will save her. Fortunately, she has no on-line bank or credit card accounts.
  - artursapek 3y ago
    Yeah she probably shouldn’t be managing her finances lol
- domador 3y ago
  Not everyone has a B.S. detector and even sophisticated users can be vulnerable to sophisticated scams. Education can be helpful, but I'd prefer to rely primarily on structural solutions that could even protect the woefully uneducated.
Acrobatic_Road 3y ago
isn't there a technology that wants to replace email that does this? I can't remember the name.
- domador 3y ago
  A bunch of geniuses have wanted to replace email, but somehow that never seems to happen. Making email more secure may be very difficult, but still seems much easier than replacing it.
nostrademons 3y ago
This works until it doesn't. A classic example of someone that would want this 99.99% of the time but find the remaining 0.01% a showstopper might be a new parent. Blocking all the solicitors, scams, strangers, salespeople et al sounds great - until your kid is lost, finds a friendly adult with a cell phone, tries to call you, and can't get through because nobody that isn't on the whitelist can reach you. (Yes, we still have our kids memorize our phone numbers, or write them on labels with the kid.). It also doesn't really get better as you get older - if you're 70 years old and your 40-year-old kid is in a car accident and the doctor's trying to reach you, you would probably want to know.
- chaostheory 3y ago
  I largely agree with you, but in our metro the question isn’t whether a child has a cell phone, but whether or not it’s a smart phone or a dumb one. Having a smart phone also helps with location tracking.
- r3trohack3r 3y ago
  The issue is identity not phone numbers. Most (all?) protocols conflate the two. But the real world doesn’t speak in phone numbers, ip addresses, and private keys.
  - nine_k 3y ago
    This is immaterial here. If your loved one is in a hospital unconscious, it's a random doctor or a police officer who is going to contact you. Group identities could help though. Let through emails and calls that are signed by a "official medical use" key, or "official federal police use" key. The public keys for those should be publicly available and easily verifiable. User-level PKI is hard, and trust is shaky. Few well-known signature keys should be much easier. The infrastructure could, of course, be used for whatever other keys you choose to track and trust, e.g. your employer's org, your kid's school, etc. The problem of responsible stewardship remains, but is likely solvable in serious organizations with a dedicated IT department, like a hospital, or a police force.
empyrrhicist 3y ago
In many graduate academic contexts, it is standard procedure for applicants to cold-email a PDF copy of their resume to prospective advisors, who then open said PDF and read it. It blows my mind.
- jononomo 3y ago
  Presumably there would be a note in the email accompanying the resume that would give some context. But if PDFs are really so dangerous to open, then that should be fixed -- it is completely unreasonable to expect people not to open PDF documents.
  - empyrrhicist 3y ago
    The context is some unknown student applying to a department, which could easily be faked (ideal phishing target). PDF is a security nightmare, and while it's gotten better with e.g. sandboxed browser viewers, it still requires trust. People need to be able to open PDF documents, but unless there's a prior professional or personal relationship, or a stable and identifiable corporate entity involved, it's a bad idea. That obviously doesn't apply to PDFs you go out and find from sources you trust. In the case I'm referring to, the solution is to have a standard application process, usually involving a nominal fee. That adds intermediaries, as well as some standardization for fairness sake.
    - jltsiren 3y ago
      Academic application processes are often informal, because nobody wants to deal with university bureaucracy unless they absolutely have to. Even when there is a formal process, the standard practice is usually contacting the people first, to see if there is any point in subjecting yourself to the process. Application fees can be substantial barriers to some people. The academia is international, and international payments are often difficult outside the trivial cases. For example, there are plenty of Iranian grad students around the world, but sanctions make many things difficult for them.
      - 3y ago
fortran77 3y ago
> So many of these scams start the same way: when the victim is contacted by a random person. Actually, they often start when a user gotes to a malicious webset that tells him his computer is "infected" and to call a number. These websites purport to have found a "virus" on your computer and you should call tech support. My 90 year old mother, fortunately, panics when she sees them and calls me. As she gets more and more confused, she may someday call the number. (Another fortuante thing -- she does NO online banking!) And these pages are very common--and on legitimate domains! If your local plumber or hair salon doesn't keep its wordpress website up to date, you can visit their site and see one of these fake warning pages.
- domador 3y ago
  How did that user get to such a website in the first place? Through a link in an email message? The ability to receive such messages from random people should be locked down, if a user or their IT security guardian has so chosen. Through a website? Maybe that user or their IT security trustee would prefer for their browser to be locked down so they can only access a website from a whitelist that's been customized for them. Maybe they can still access their local hair salon's website, but not the site linked to fake warning page that shows up on that site. Not every user needs to be able to go to any corner of the web on a whim. Maybe my elderly future self needs to have less freedom of inquiry, as much as it pains to think of that likely future.
  - fortran77 3y ago
    > How did that user get to such a website in the first place? Through a link in an email message? Nope. Through an expired domain of a once-legit site that was taken over, or through a mom-and-pop legit business that had their website taken over because of a wordpress bug. My brother mentioned to me the other day that he got to a "computer has been infected -- call this number" website from clicking on a Facebook ad!
deleted 3y ago
[deleted]
tedunangst 3y ago
So how would I sign up for a service like Spotify? I have to first login to my email and enter what, exactly? I go to Spotify and get their outbound email and copy it, then switch tabs, then switch back, then switch back, then switch back again?
- domador 3y ago
  Under one possible protocol, you'd generate and give Spotify a special key that they'd need to send you along with any of their message to you. (Spotify would include a field in their account-creation process and existing-account settings where you could specify such a key.) You'd either manually look for that key in any message you received from Spotify or (ideally) you'd set up your email client/service to reject any emails from Spotify unless they also include the special key you gave them. (Maybe such keys could be placed in a custom X-header specified by this protocol.) If this were a common and popular protocol, it'd be easy to generate per-service-and-per-account keys, provide them to a service, and set them up for whitelisting in your email client/service.
- spion 3y ago
  You use OpenID which sorta does all of this for you.
bsder 3y ago
This isn't hard. 1) Either your identity is blocked or your identity must be validated when it comes up on the phone. Problem solved. Phone companies know when they are selling to scammers and spammers. Hold them liable for fraud when companies are making misrepresentations. 2) "Identity theft" should be a verboten term and it should be called "financial fraud" and the banks that enable it held liable Holding the banks liable for financial scams would cause the banks to identify things properly and spend the appropriate amount of money to stop them.
- domador 3y ago
  "Identity theft" seems very much a cop out and what I would call a "nomenclature scam" (new term, courtesy of me) which places the onus of security on individual customers, instead of on the financial institutions that would be much better equipped to prevent scams. It should not be possible for anyone to open up a new line of credit remotely, without physically showing up at bank office where they will be properly identified. Any such attempt should trigger a process which will (through a different channel) verifiably notify the person who is purportedly attempting to open a line of credit. Furthermore, I would personally like credit bureaus to let me turn on an optional setting that tells financial institutions that they must card, photograph, get a video of, fingerprint, and get a DNA sample from anyone who attempts to open a line of credit in my name. There are other ways in which banks tend to make losing money way too easily. I should be able to lock down an account or a given sum of money in an account that would prevent that money from being transferred anywhere unless I first show up at a bank office, am properly identified, and remove that lock. Ideally bank officers would be forced to ask me a few basic questions that could help me realize that I may be falling for a scam. They could also inform me of the most common and newest forms of scams before finalizing the account unlocking process. If I so choose, I want to be able to NOT have the option of being to clear out my accounts through online banking sessions. On a different note, why are bank and credit card account statements so nearly useless in identifying where one's money is transferred? It's high time to upgrade ancient banking networks! Banks should expand the amount of space available for describing each transaction, along with providing the recipient's account number, financial institution name and ID , state/province and country. As it is, I often have trouble identifying many legitimate purchases I made, much less potentially fraudulent transactions.
janalsncm 3y ago
My solution to this would be to charge a small amount (say $0.01) to send an email to someone not in your contacts. You pay a dollar to onboard to the service, and each time you send an email to a random person it would charge a penny. If you receive a reply the penny is refunded (presumably because they were interested enough). This works because it breaks the economics of spam. If one in a million people fall for your $1000 scam, that’s a profit of $0.001/email. Thats ok if emails cost nothing to send. But if they cost $0.01 to send, it doesn’t make sense to send them.

artursapek 3y ago

I like this line of thinking, but I think education is the key. Even with good filters you have to be able to smell bullshit. I enabled iOS “silence unknown callers” option as soon as they added it, but found I miss important calls sometimes. I rely on voicemail for those. There’s no way to completely whitelist your personal communications in this world. I do get scam voicemails and emails sometimes, but am good at detecting them.

fortran77 3y ago
> I like this line of thinking, but I think education is the key. My 90 year old mother gets less and less able to think clearly each passing month. She always is calling me telling me that "her computer is completely dead" and it takes my 10 minutes to realize it's just her mouse that's not working becasue she forgot to charge it. No amount of education will save her. Fortunately, she has no on-line bank or credit card accounts.
- artursapek 3y ago
  Yeah she probably shouldn’t be managing her finances lol
domador 3y ago
Not everyone has a B.S. detector and even sophisticated users can be vulnerable to sophisticated scams. Education can be helpful, but I'd prefer to rely primarily on structural solutions that could even protect the woefully uneducated.

Acrobatic_Road 3y ago

isn't there a technology that wants to replace email that does this? I can't remember the name.

domador 3y ago
A bunch of geniuses have wanted to replace email, but somehow that never seems to happen. Making email more secure may be very difficult, but still seems much easier than replacing it.

nostrademons 3y ago

This works until it doesn't. A classic example of someone that would want this 99.99% of the time but find the remaining 0.01% a showstopper might be a new parent. Blocking all the solicitors, scams, strangers, salespeople et al sounds great - until your kid is lost, finds a friendly adult with a cell phone, tries to call you, and can't get through because nobody that isn't on the whitelist can reach you. (Yes, we still have our kids memorize our phone numbers, or write them on labels with the kid.). It also doesn't really get better as you get older - if you're 70 years old and your 40-year-old kid is in a car accident and the doctor's trying to reach you, you would probably want to know.

chaostheory 3y ago
I largely agree with you, but in our metro the question isn’t whether a child has a cell phone, but whether or not it’s a smart phone or a dumb one. Having a smart phone also helps with location tracking.
r3trohack3r 3y ago
The issue is identity not phone numbers. Most (all?) protocols conflate the two. But the real world doesn’t speak in phone numbers, ip addresses, and private keys.
- nine_k 3y ago
  This is immaterial here. If your loved one is in a hospital unconscious, it's a random doctor or a police officer who is going to contact you. Group identities could help though. Let through emails and calls that are signed by a "official medical use" key, or "official federal police use" key. The public keys for those should be publicly available and easily verifiable. User-level PKI is hard, and trust is shaky. Few well-known signature keys should be much easier. The infrastructure could, of course, be used for whatever other keys you choose to track and trust, e.g. your employer's org, your kid's school, etc. The problem of responsible stewardship remains, but is likely solvable in serious organizations with a dedicated IT department, like a hospital, or a police force.

empyrrhicist 3y ago

In many graduate academic contexts, it is standard procedure for applicants to cold-email a PDF copy of their resume to prospective advisors, who then open said PDF and read it. It blows my mind.

jononomo 3y ago
Presumably there would be a note in the email accompanying the resume that would give some context. But if PDFs are really so dangerous to open, then that should be fixed -- it is completely unreasonable to expect people not to open PDF documents.
- empyrrhicist 3y ago
  The context is some unknown student applying to a department, which could easily be faked (ideal phishing target). PDF is a security nightmare, and while it's gotten better with e.g. sandboxed browser viewers, it still requires trust. People need to be able to open PDF documents, but unless there's a prior professional or personal relationship, or a stable and identifiable corporate entity involved, it's a bad idea. That obviously doesn't apply to PDFs you go out and find from sources you trust. In the case I'm referring to, the solution is to have a standard application process, usually involving a nominal fee. That adds intermediaries, as well as some standardization for fairness sake.
  - jltsiren 3y ago
    Academic application processes are often informal, because nobody wants to deal with university bureaucracy unless they absolutely have to. Even when there is a formal process, the standard practice is usually contacting the people first, to see if there is any point in subjecting yourself to the process. Application fees can be substantial barriers to some people. The academia is international, and international payments are often difficult outside the trivial cases. For example, there are plenty of Iranian grad students around the world, but sanctions make many things difficult for them.
    - 3y ago

fortran77 3y ago

> So many of these scams start the same way: when the victim is contacted by a random person. Actually, they often start when a user gotes to a malicious webset that tells him his computer is "infected" and to call a number. These websites purport to have found a "virus" on your computer and you should call tech support. My 90 year old mother, fortunately, panics when she sees them and calls me. As she gets more and more confused, she may someday call the number. (Another fortuante thing -- she does NO online banking!) And these pages are very common--and on legitimate domains! If your local plumber or hair salon doesn't keep its wordpress website up to date, you can visit their site and see one of these fake warning pages.

domador 3y ago
How did that user get to such a website in the first place? Through a link in an email message? The ability to receive such messages from random people should be locked down, if a user or their IT security guardian has so chosen. Through a website? Maybe that user or their IT security trustee would prefer for their browser to be locked down so they can only access a website from a whitelist that's been customized for them. Maybe they can still access their local hair salon's website, but not the site linked to fake warning page that shows up on that site. Not every user needs to be able to go to any corner of the web on a whim. Maybe my elderly future self needs to have less freedom of inquiry, as much as it pains to think of that likely future.
- fortran77 3y ago
  > How did that user get to such a website in the first place? Through a link in an email message? Nope. Through an expired domain of a once-legit site that was taken over, or through a mom-and-pop legit business that had their website taken over because of a wordpress bug. My brother mentioned to me the other day that he got to a "computer has been infected -- call this number" website from clicking on a Facebook ad!

deleted 3y ago

[deleted]

tedunangst 3y ago

So how would I sign up for a service like Spotify? I have to first login to my email and enter what, exactly? I go to Spotify and get their outbound email and copy it, then switch tabs, then switch back, then switch back, then switch back again?

domador 3y ago
Under one possible protocol, you'd generate and give Spotify a special key that they'd need to send you along with any of their message to you. (Spotify would include a field in their account-creation process and existing-account settings where you could specify such a key.) You'd either manually look for that key in any message you received from Spotify or (ideally) you'd set up your email client/service to reject any emails from Spotify unless they also include the special key you gave them. (Maybe such keys could be placed in a custom X-header specified by this protocol.) If this were a common and popular protocol, it'd be easy to generate per-service-and-per-account keys, provide them to a service, and set them up for whitelisting in your email client/service.
spion 3y ago
You use OpenID which sorta does all of this for you.

bsder 3y ago

This isn't hard. 1) Either your identity is blocked or your identity must be validated when it comes up on the phone. Problem solved. Phone companies know when they are selling to scammers and spammers. Hold them liable for fraud when companies are making misrepresentations. 2) "Identity theft" should be a verboten term and it should be called "financial fraud" and the banks that enable it held liable Holding the banks liable for financial scams would cause the banks to identify things properly and spend the appropriate amount of money to stop them.

domador 3y ago
"Identity theft" seems very much a cop out and what I would call a "nomenclature scam" (new term, courtesy of me) which places the onus of security on individual customers, instead of on the financial institutions that would be much better equipped to prevent scams. It should not be possible for anyone to open up a new line of credit remotely, without physically showing up at bank office where they will be properly identified. Any such attempt should trigger a process which will (through a different channel) verifiably notify the person who is purportedly attempting to open a line of credit. Furthermore, I would personally like credit bureaus to let me turn on an optional setting that tells financial institutions that they must card, photograph, get a video of, fingerprint, and get a DNA sample from anyone who attempts to open a line of credit in my name. There are other ways in which banks tend to make losing money way too easily. I should be able to lock down an account or a given sum of money in an account that would prevent that money from being transferred anywhere unless I first show up at a bank office, am properly identified, and remove that lock. Ideally bank officers would be forced to ask me a few basic questions that could help me realize that I may be falling for a scam. They could also inform me of the most common and newest forms of scams before finalizing the account unlocking process. If I so choose, I want to be able to NOT have the option of being to clear out my accounts through online banking sessions. On a different note, why are bank and credit card account statements so nearly useless in identifying where one's money is transferred? It's high time to upgrade ancient banking networks! Banks should expand the amount of space available for describing each transaction, along with providing the recipient's account number, financial institution name and ID , state/province and country. As it is, I often have trouble identifying many legitimate purchases I made, much less potentially fraudulent transactions.

janalsncm 3y ago

My solution to this would be to charge a small amount (say $0.01) to send an email to someone not in your contacts. You pay a dollar to onboard to the service, and each time you send an email to a random person it would charge a penny. If you receive a reply the penny is refunded (presumably because they were interested enough). This works because it breaks the economics of spam. If one in a million people fall for your $1000 scam, that’s a profit of $0.001/email. Thats ok if emails cost nothing to send. But if they cost $0.01 to send, it doesn’t make sense to send them.