3 ms·

> Is it your fate now to do due diligence on every email you receive? Always has been. Tbh the browser/email client makers are complicit in these phishing att

> Is it your fate now to do due diligence on every email you receive? Always has been. Tbh the browser/email client makers are complicit in these phishing attempts for hiding the URLs and the actual email addresses. Put them back!

HPsquared 2y ago
Also the URL "security scanner" things on corporate email systems. The user can't see the URL by hovering over it.
- reginald78 2y ago
  I was about to complain about this. I take security training to inspect URLs and then Microsoft safe link or whatever it's called gives me a twenty line long URL filled with random characters. I have to trust it works since they took my manual inspection ability away.
  - Grimblewald 2y ago
    i am fairly certain that whole thing is about tracking and not security. If it was about security, then they could still include the real URL in the "safeurl" url. They do not do this though, because it is not about safety, it is about data.
- switch007 2y ago
  When the security team does that, they give up all right to tell people to analyse URLs, and assume all responsibility for anything bad happening from clicking on links. As they're advertising links as secure
nonrandomstring 2y ago
> Tbh the browser/email client makers are complicit in these phishing attempts for hiding the URLs and the actual email addresses. It's worse. Research "Scamicry". Big business now is so fake, such a grift, drenched in PR deception, and lacking integrity and trustworthiness, there isn't much space left between what is "legitimate" and what is a scam. If businesses like Google or Facebook hide URLs and email addresses that's not a casual "mistake". It's because that's to their profitable advantage to do so. And they know it puts you in harms way. So yes, they're complicit in scams. To make themselves a little more competitive businesses are always learning from scammers, meanwhile good scammers keenly learn from businesses to look more legit. Some ransomware "services" even have better customer support than billion dollar companies. And big business is certainly using the same AI tools as cybercriminals. So a problem isn't how clever and scurrilous scammers have gotten, it's how far legitimate services have fallen so that ordinary folk struggle to know the difference. How can we trust our own insticts for selecting what is good and wholesome from what is rotten, when there are few moral differences? The only difference resides in a digital identifier.
- smeej 2y ago
  I beat that drum so long it turned into beating my head against a wall. The last two companies I worked for insisted that customer account security was the highest priority, but as soon as I said we needed to stop hiding links to our own website behind Hubspot tracking URLs so we don't train our customers to click links that look like gobbledygook garbage, the marketing team melted down and it became clear where user account security actually fell on the priority list. I don't think it's always malicious, though. I think most people in most companies just don't realize the risk. Like, I had to explain to my doctor's office why I'm never going to "confirm my identity" by rattling off my DOB and address at the beginning of a call when they called me. I even think of those specific data points as public information anyway and I'm not going to participate in that nonsense. It had never occurred to them that this was risky behavior. It did make me appreciate my parish priest's method, though. Every quarter or so, he reminds people from the pulpit that he will never email them asking for gift cards or anything of the sort. If the parish needs money for something, he promises he'll ask for it right from the pulpit!
  - nerdponx 2y ago
    People realize the risk, they just think it can't happen to them personally, and/or just don't care because they personally aren't going to bear the risk. People run businesses the way they drive their cars, i.e. selfishly and arrogantly.
    - nonrandomstring 2y ago
      Are all people bad drivers? Technology gives diffusion of responsibility. And business gives limited liability. Put them together and you have magnified sense of agency and invulnerability. But without wheels and a windshield people couldn't travel at 100 miles an hour. The question is how gracefully the person at the wheel handles that. Are you a gentleman in a Jaguar or a BMW driver? [0] [0] https://www.fastcompany.com/90457589/science-proves-it-men-who-own-mercedes-and-bmws-are-more-likely-to-be-assholes https://www.fastcompany.com/90457589/science-proves-it-men-w...

HPsquared 2y ago

Also the URL "security scanner" things on corporate email systems. The user can't see the URL by hovering over it.

reginald78 2y ago
I was about to complain about this. I take security training to inspect URLs and then Microsoft safe link or whatever it's called gives me a twenty line long URL filled with random characters. I have to trust it works since they took my manual inspection ability away.
- Grimblewald 2y ago
  i am fairly certain that whole thing is about tracking and not security. If it was about security, then they could still include the real URL in the "safeurl" url. They do not do this though, because it is not about safety, it is about data.
switch007 2y ago
When the security team does that, they give up all right to tell people to analyse URLs, and assume all responsibility for anything bad happening from clicking on links. As they're advertising links as secure

nonrandomstring 2y ago

> Tbh the browser/email client makers are complicit in these phishing attempts for hiding the URLs and the actual email addresses. It's worse. Research "Scamicry". Big business now is so fake, such a grift, drenched in PR deception, and lacking integrity and trustworthiness, there isn't much space left between what is "legitimate" and what is a scam. If businesses like Google or Facebook hide URLs and email addresses that's not a casual "mistake". It's because that's to their profitable advantage to do so. And they know it puts you in harms way. So yes, they're complicit in scams. To make themselves a little more competitive businesses are always learning from scammers, meanwhile good scammers keenly learn from businesses to look more legit. Some ransomware "services" even have better customer support than billion dollar companies. And big business is certainly using the same AI tools as cybercriminals. So a problem isn't how clever and scurrilous scammers have gotten, it's how far legitimate services have fallen so that ordinary folk struggle to know the difference. How can we trust our own insticts for selecting what is good and wholesome from what is rotten, when there are few moral differences? The only difference resides in a digital identifier.

smeej 2y ago
I beat that drum so long it turned into beating my head against a wall. The last two companies I worked for insisted that customer account security was the highest priority, but as soon as I said we needed to stop hiding links to our own website behind Hubspot tracking URLs so we don't train our customers to click links that look like gobbledygook garbage, the marketing team melted down and it became clear where user account security actually fell on the priority list. I don't think it's always malicious, though. I think most people in most companies just don't realize the risk. Like, I had to explain to my doctor's office why I'm never going to "confirm my identity" by rattling off my DOB and address at the beginning of a call when they called me. I even think of those specific data points as public information anyway and I'm not going to participate in that nonsense. It had never occurred to them that this was risky behavior. It did make me appreciate my parish priest's method, though. Every quarter or so, he reminds people from the pulpit that he will never email them asking for gift cards or anything of the sort. If the parish needs money for something, he promises he'll ask for it right from the pulpit!
- nerdponx 2y ago
  People realize the risk, they just think it can't happen to them personally, and/or just don't care because they personally aren't going to bear the risk. People run businesses the way they drive their cars, i.e. selfishly and arrogantly.
  - nonrandomstring 2y ago
    Are all people bad drivers? Technology gives diffusion of responsibility. And business gives limited liability. Put them together and you have magnified sense of agency and invulnerability. But without wheels and a windshield people couldn't travel at 100 miles an hour. The question is how gracefully the person at the wheel handles that. Are you a gentleman in a Jaguar or a BMW driver? [0] [0] https://www.fastcompany.com/90457589/science-proves-it-men-who-own-mercedes-and-bmws-are-more-likely-to-be-assholes https://www.fastcompany.com/90457589/science-proves-it-men-w...