3 ms·

I don't think Troy Hunt is recommending what you're suggesting at all? The very beginning of the post starts with: > but I'm a smart human so I don't fall for

by avarun 3y ago

I don't think Troy Hunt is recommending what you're suggesting at all? The very beginning of the post starts with: > but I'm a smart human so I don't fall for this (that's a joke, read why humans are bad at URLs). It's clear that he thinks relying on heuristics to distinguish scammy URLs is not a scalable long term approach.

hn_throwaway_99 3y ago
Two things: 1. The entire article is about a (surprisingly) legit FedEx SMS looking totally spammy. My point is that we should take "looking totally scammy" completely out of our vocabulary, and pointing out similarities or differences in scam vs real notifications only furthers the notion that they're distinguishable in the first place. Again, to emphasize, I still think this overall was a great article highlighting the ineptitude of FedEx sending such egregiously bad notifications in the first place 2. Hunt says exactly this in the article "But if I were to take a guess, they've merely blocked the tip of the iceberg. This is why in addition to technical controls, we reply [sic] on human controls which means helping people identify the patterns of a scam: requests for money, a sense of urgency, grammar and casing that's a bit off, add [sic] looking URLs." My point is we should stop "helping people identify patterns of a scam". We should instead just teach people to treat all incoming notifications as suspect and to never follow a link/phone number from an incoming message.
- WorldMaker 3y ago
  On that second point that is what Troy Hunt shows doing: he goes to the FedEx website and finds no indicator of any duties/taxes in the official package tracker. This seems a case where the Australian customs team doesn't have feature access to the main website to service this case and are instead badly routing around it. I think this is the core point Troy Hunt is trying to show, but I don't think Troy Hunt makes it explicit enough that this org chart/processes problem is the real problem and the thing FedEx should most fix because you can't rely on incoming notifications to not look scammy, real notifications are indistinguishable from fake ones even if the real ones weren't doing so horribly to begin with. Troy Hunt often makes that point better in other posts (see the old, long series on "Extended Validation" certificates for an example) and maybe just assumed that message was clear rather than harping on it and then resummarizing it in bold text and blinking lights this post.

by avarun 3y ago

hn_throwaway_99 3y ago

Two things: 1. The entire article is about a (surprisingly) legit FedEx SMS looking totally spammy. My point is that we should take "looking totally scammy" completely out of our vocabulary, and pointing out similarities or differences in scam vs real notifications only furthers the notion that they're distinguishable in the first place. Again, to emphasize, I still think this overall was a great article highlighting the ineptitude of FedEx sending such egregiously bad notifications in the first place 2. Hunt says exactly this in the article "But if I were to take a guess, they've merely blocked the tip of the iceberg. This is why in addition to technical controls, we reply [sic] on human controls which means helping people identify the patterns of a scam: requests for money, a sense of urgency, grammar and casing that's a bit off, add [sic] looking URLs." My point is we should stop "helping people identify patterns of a scam". We should instead just teach people to treat all incoming notifications as suspect and to never follow a link/phone number from an incoming message.

WorldMaker 3y ago
On that second point that is what Troy Hunt shows doing: he goes to the FedEx website and finds no indicator of any duties/taxes in the official package tracker. This seems a case where the Australian customs team doesn't have feature access to the main website to service this case and are instead badly routing around it. I think this is the core point Troy Hunt is trying to show, but I don't think Troy Hunt makes it explicit enough that this org chart/processes problem is the real problem and the thing FedEx should most fix because you can't rely on incoming notifications to not look scammy, real notifications are indistinguishable from fake ones even if the real ones weren't doing so horribly to begin with. Troy Hunt often makes that point better in other posts (see the old, long series on "Extended Validation" certificates for an example) and maybe just assumed that message was clear rather than harping on it and then resummarizing it in bold text and blinking lights this post.