Hacker News Reader

In my experience if you use multiple Google accounts you get login prompts all the time: half the time the Google Doc/Drive link requires me to switch to another account, and occasionally asking for password confirmation as well.

Or it could come from an already infected account, which might make the e-mail even less suspicious.

Yes but this would just mean an even bigger part of the story is missing — how that one got compromised.

Hi, I'm the author of that blog post. The backstory is that, indeed, the "familiar mailing list" had been compromised; the attack was conveyed to us in much the same way as we passed it on to others.

I mean, I don't think the argument at any point is that it couldn't have possibly been prevented or that nobody made a mistake in this story.

Sharing links is so common that if you want to punish users for that you can't run your business anymore.

But yeah they shouldn't login on sites that the password isn't auto completed for.