5 ms·

Yesterday I got a mail from Facebook: "*Woman_I_have_known mentioned you on Facebook". Haven't used FB in years, mail looks legit, I get kinda curious. I tap i

Yesterday I got a mail from Facebook: "*Woman_I_have_known mentioned you on Facebook". Haven't used FB in years, mail looks legit, I get kinda curious. I tap it, and am immediately logged in, in DDG browser (which has 0 cookies when closing)! To top it off, she didn't mention me, she mentioned some #tag on some stupid lottery for a van. It's so disrespectful. So dirty. I know they don't give a * about me, but do they have to put it on so thick?

AndriyKunitsyn 1y ago
A mention without a mention - I get that, but why do you think it's dirty to skip the log in?
- compiler-guy 1y ago
  If they had forwarded that mail to someone else--"Hey look! Someone mentioned me on facebook!"--then that second person could have logged into the first person's account with a single tap. It's scummy and terribly insecure to pass around someone else's credentials via email.
  - maerch 1y ago
    That was my first thought. This can go downhill pretty quickly. Nobody suspects that you expose your account with a link to a mention.
- jmathai 1y ago
  Look at the context of the email he received. It's a lie to get him onto the site and to start scrolling. In that context, skipping the login is pretty dirty.
- ivanmontillam 1y ago
  because though we know BigCo know too much about us nore than ourselves, revealling that ugly fact so frontally is tasteless.
duxup 1y ago
I wonder if Facebook has slowly began to lean into the scammer email pattern where ... they really want the people who are ok with these patterns so they can hook them in other equally scummy ways. Perhaps social media companies are not interested in anyone who wants to manage their feed or is looking for somethings specific, they want to point their product AT you, not have you use it.
- pyrale 1y ago
  Slowly begun? I’ve received this kind of email since their beginnings. The only reason they’re not #1 at this is that linkedIn does even more of it.
  - mock-possum 1y ago
    Oh my god I’ve been at the end of my rope wirh LinkedIn too. Between the obnoxious notifications and the absolute brain rot that is The Feed™ there’s basically nothing good about that site apart from the obligate profile-as-a-resume. It is so pathetic how they beg and wheedle and connive to get you to engage. I’ve honestly lost all respect for that site at this point.
    - ozim 1y ago
      I like “beg” as term for their notifications.
pyrale 1y ago
The ddg browser part is simple to explain: you followed a link that was generated specifically for this email sent to you. When you click it fb knows who you are (so they directly log you in), but also that you reacted to this specific clickbait campaign. Expect more trash from them since it worked once.
- fisherjeff 1y ago
  So if someone gains access to your email, they also get FB access…?
  - DaSHacka 1y ago
    Yes, but that's pretty common for most services. Clicking "forgot password" typically sends you an email prompting to set a new one; this is similar, in a sense.
  - groestl 1y ago
    They'll probably make you reauthenticate as soon as you do anything, but who knows...
  - nordsieck 1y ago
    > So if someone gains access to your email, they also get FB access…? I mean, that's how it works for most websites. I think I have 2FA turned on for FB, but honestly the phone system is way less secure than email at Google/Microsoft.
  - gspencley 1y ago
    Yes, these are often referred to as "Magic Links." When it comes to the security implications, consider that email has long been a "single point of failure" for a lot of services in the form of the "forgot password" feature that emails you a link to reset your password. When I'm talking to non-tech people in my life about how best to protect themselves, I usually tell them to think about priorities and disaster scenarios. What would suck the most if it got hacked? The two that are usually at the top of the list for pretty much everyone are email and online banking. Others might include Amazon accounts (hackers can order themselves gift cards with your CC if compromised etc.) Prioritize securing those with a strong password + MFA. The rest is case by case but make sure to use a password manager so you're not reusing passwords.
the_snooze 1y ago
This is a big reason why I'm so suspicious of AI. Those systems are largely backed by the same companies who have spent the last 15+ years disrespecting users and treating them as resources to extract, not actual people to serve. The ethos in tech seems to be a simplistic toddler-like mindset for "more for more's sake" that doesn't care about others' agency.
ben_w 1y ago
Yup. Somehow, despite this, they're not even that good at the one thing their business relies on, correctly targeting adverts: https://news.ycombinator.com/item?id=40083838 https://news.ycombinator.com/item?id=40083838
legacynl 1y ago
I wonder if it's part of some growth hacking scam. They want their metrics to show x amount of people logging in each month, so they show these emails that auto log you in.
- teekert 1y ago
  Yeah, I'm now back in that monthly active users group. Should have resisted more.

AndriyKunitsyn 1y ago

A mention without a mention - I get that, but why do you think it's dirty to skip the log in?

compiler-guy 1y ago
If they had forwarded that mail to someone else--"Hey look! Someone mentioned me on facebook!"--then that second person could have logged into the first person's account with a single tap. It's scummy and terribly insecure to pass around someone else's credentials via email.
- maerch 1y ago
  That was my first thought. This can go downhill pretty quickly. Nobody suspects that you expose your account with a link to a mention.
jmathai 1y ago
Look at the context of the email he received. It's a lie to get him onto the site and to start scrolling. In that context, skipping the login is pretty dirty.
ivanmontillam 1y ago
because though we know BigCo know too much about us nore than ourselves, revealling that ugly fact so frontally is tasteless.

duxup 1y ago

I wonder if Facebook has slowly began to lean into the scammer email pattern where ... they really want the people who are ok with these patterns so they can hook them in other equally scummy ways. Perhaps social media companies are not interested in anyone who wants to manage their feed or is looking for somethings specific, they want to point their product AT you, not have you use it.

pyrale 1y ago
Slowly begun? I’ve received this kind of email since their beginnings. The only reason they’re not #1 at this is that linkedIn does even more of it.
- mock-possum 1y ago
  Oh my god I’ve been at the end of my rope wirh LinkedIn too. Between the obnoxious notifications and the absolute brain rot that is The Feed™ there’s basically nothing good about that site apart from the obligate profile-as-a-resume. It is so pathetic how they beg and wheedle and connive to get you to engage. I’ve honestly lost all respect for that site at this point.
  - ozim 1y ago
    I like “beg” as term for their notifications.

pyrale 1y ago

The ddg browser part is simple to explain: you followed a link that was generated specifically for this email sent to you. When you click it fb knows who you are (so they directly log you in), but also that you reacted to this specific clickbait campaign. Expect more trash from them since it worked once.

fisherjeff 1y ago
So if someone gains access to your email, they also get FB access…?
- DaSHacka 1y ago
  Yes, but that's pretty common for most services. Clicking "forgot password" typically sends you an email prompting to set a new one; this is similar, in a sense.
- groestl 1y ago
  They'll probably make you reauthenticate as soon as you do anything, but who knows...
- nordsieck 1y ago
  > So if someone gains access to your email, they also get FB access…? I mean, that's how it works for most websites. I think I have 2FA turned on for FB, but honestly the phone system is way less secure than email at Google/Microsoft.
- gspencley 1y ago
  Yes, these are often referred to as "Magic Links." When it comes to the security implications, consider that email has long been a "single point of failure" for a lot of services in the form of the "forgot password" feature that emails you a link to reset your password. When I'm talking to non-tech people in my life about how best to protect themselves, I usually tell them to think about priorities and disaster scenarios. What would suck the most if it got hacked? The two that are usually at the top of the list for pretty much everyone are email and online banking. Others might include Amazon accounts (hackers can order themselves gift cards with your CC if compromised etc.) Prioritize securing those with a strong password + MFA. The rest is case by case but make sure to use a password manager so you're not reusing passwords.

the_snooze 1y ago

This is a big reason why I'm so suspicious of AI. Those systems are largely backed by the same companies who have spent the last 15+ years disrespecting users and treating them as resources to extract, not actual people to serve. The ethos in tech seems to be a simplistic toddler-like mindset for "more for more's sake" that doesn't care about others' agency.

ben_w 1y ago

Yup. Somehow, despite this, they're not even that good at the one thing their business relies on, correctly targeting adverts: https://news.ycombinator.com/item?id=40083838 https://news.ycombinator.com/item?id=40083838

legacynl 1y ago

I wonder if it's part of some growth hacking scam. They want their metrics to show x amount of people logging in each month, so they show these emails that auto log you in.

teekert 1y ago
Yeah, I'm now back in that monthly active users group. Should have resisted more.