Hacker News Reader

A lot of good points, but not all of them feel valid.

> not known by the security staff.

They may just not care, or at least not make that a priority. If the dongle stuff was done just to comply to some norm or regulation, actual security could be perceived to be secondary.

> The writer already assumes that we think he is lying.

Not quite. He assumes we think he could be mistaken. ("[…] it could be conceivable […] that, in my grief, I remotely logged in, sent the email and forgot I did it"). Still a bit fishy, but not as much as you make it sound.

> is it very likely not to check your email at least just before you show up at work 6 weeks later?

That can be estimated, but not that if it were me, that would be a virtual certainty. I never check my work email outside of work. I go to work first, then I check my email.

> It is a throwaway account.

Of course it is. One does not want to tie a long term account (which may be tied to a meat-space identity) with negative stuff like that. The evidence by throwaway is practically nil.

> > The writer already assumes that we think he is lying.

> Not quite. He assumes we think he could be mistaken. ("[…] it could be conceivable […] that, in my grief, I remotely logged in, sent the email and forgot I did it"). Still a bit fishy, but not as much as you make it sound.

Not quite assuming that we think he's lying, but a very common tell for lies is that the lier is preempting challenges to weak points in the story.

A lot hinges on his location and the exact job, but it smells very fishy that he apparently is set up for remote access to email (so it sounds like a "regular" knowledge worker job where checking your email from not-the-office at times is not uncommon), but when leaving very suddenly, ie. with no time to hand over work to colleagues, as you'd normally do for planned leave, he wouldn't bring the dongle with him, to be able to check in and make sure his colleagues have what they need to move on without him.

Thanks for actually pointing out all those things that made me feel as if the story was made up.

I would add the general style of the write up. It does not seem like a person being actually keen to receive an answer but is written like a tale. For example, notice the start of each paragraph: "Anyway"; "now maybe"; "the fact is". (That might be his personal way of writing as well, but it adds to the suspicious feeling)

And of course the fact that one can simply quit by Email, especially after having worked at a company for a long time seems highly unlikely, I would at least expect them to call you before moving on.

I know of a few instances of people resigning by email. Two weeks ago, one project manager and one engineer quit by email from my parents' company on the same day. In one instance, I started working as a replacement for the engineer the day after. It's not inconceivable to me that a CEO would take that email as formal notice, or that they might find a replacement within 6 weeks.

> is it very likely not to check your email at least just before you show up at work 6 weeks later?

a work dongle is needed to read reply email and he said that he didn't bring it.

Of course, my bad! That actually neatly fits the story line.

But you're not going to call or email that you're coming in on X date after being gone for 6 weeks or so with no specified return date?

> is it very likely not to check your email at least just before you show up at work 6 weeks later?

This very much depends on the country, and local employment expectations. There's the old joke comparing US and European "out-of-office" auto replies:

US: "I am on holidays, but I'll check in with my email about every night. I can be reached at $PHONE_NUMBER for an emergency"

Europe: "I am on holiday. I will return in 4 weeks."

This is very much a personal preference and not a culture/company thing. I've worked for companies with great work-life balance where some employees (including non-management) would check emails over the weekend or when on vacation. And I've worked for companies that had an expectation you check email on the weekends where some employees (including management) would not do anything over a holiday.

Although some of these hypotheses are vaguely plausible I think it is outrageous to lay all the suspicion on a potential victim. I'm not saying we should be naive and take everything for granted in this story but the least we can do is assume he's telling the truth before advocating the devil - specially in regards of a mothers death.

Also :

+ if it was holidays or a child he wouldn't have left in a rush : those departure should arguably be prepared in advance

+ "Technological details" are very vague and sounds like something he overheard but didn't understand or know how to use.

+ the throwaway account means nothing and could very well plead in his favour : he's not sure he wants to spend time attacking his company so he stays anonymous before taking a rushed decision.

+ not checking his email is consistent with not having the dongle !

> but the least we can do is assume he's telling the truth before advocating the devil - specially in regards of a mothers death.

Thanks for your counterarguments. I of course admit that my assumptions are assumptions and henceforth definitely not airtight. However, I just wanted to say that I would have never actually responded to that question itself with how I commented on HN, just to be safe.

I am biased because I read HN daily and kind of assume everybody does - including the author of the story. Which is silly...

Nevertheless I strongly believe in the presumption of innocence, even outside of court, as a general moral rule we owe to others.

Outrageous might of been a little strong though :)

Who's "advocating the devil"?

It's only outrageous if you act on the suspicion.

https://en.wikipedia.org/wiki/Devil%27s_advocate

Playing devils advocate might not be the correct term, as the suspicion seems genuine.

Assuming it is fake then it could possibly be a CEO asking the experts "can I get away with this?"

CEO couldn't, it's fraud, but employee laws / rights in the US are pretty shoddy to begin with so I'm sure just firing the guy normally wouldn't be too difficult.

+ The lack of follow up answer to the question "Which country are you in?"

True, I've omitted the things that seem to be platform specific.

+ No follow up comments on questions for some more info or thanking people that feel for him.

+ Using a very general name as nickname (although not English).

+ A throwaway account. Although it's understandable, because it is a personal story; if this would happen to me everyone would know.

It also interesting to see how good the story is. When people respond to this in the sense of "who did it?", they come up with the CEO. If he would have weaved in the name of one of his colleagues that used to joke around with fake email addresses, the story plot becomes weaker.

Yup, doesn't want to give any more details in case the story gets unpicked

Also the fact that it seems no one from his work (bosses or colleagues) phoned him or made contact in his absence to enquire about his or his mother's wellbeing to empathise with him on his resignation (which would have therefore eliminated his "surprise" on his return.

The other thing that is odd is that they mentioned their mother's illness took a turn for the worse and they were communicating with only the CEO via phone. It seems unlikely that you only let the CEO know at the beginning of your absence and then don't let him/her know when you will actually be coming back. It also seems unlikely that the company would accept your resignation, post the position, interview, make an offer, and have the new person start all within 6 weeks. Perhaps it is just me, but that seems like an aggressive timeframe to get all of that done.

'Technological "details" that do not seem to make sense'

It's not unusual for database servers to have functions available to send emails from stored procedures - it doesn't seem completely unlikely to me that someone could use something like this to send spoof emails.

+ Shrugging-off an act of felony being committed.

Nevertheless, it does pose a more general question. Given that in many workplaces the employer has access to your work email/account, how can one prove that he/she did not send a particular email?

There's a large amount of information generated when you send an email, and a whole branch of IT (digital forensics) with many dedicated professionals who deal with such things routinely.

Even though I only worked peripherally with digital forensics people, and I know a lot about how email/computers/networks work, I know enough to know that I could never get away with forging an email (especially not one where anything serious depended on it).

Still, as far as I understand it, it comes down to how good/competent the IT dept is at log-keeping, and how complicit they are in the forgery.

In a more broader way, how can one prove innocence if their company use the employee's credentials (ID/email/etc.) to drop the blame on them? Wouldn't it be the employees words against the employer, while at the same time the employer has the control over the data/evidence?

If they are clued up enough to require 2FA to send email remotely, they're clued up enough to keep logs.

Digital forensics professionals deal all the time with attempts at active fraud (eg. people deleting logs, clearing caches, etc). Even if the IT department didn't keep the logs, or tried to delete them, there would be some "Data remanence" on one of the various machines involved in sending/transmitting/receiving the email.

Do digital forensics professionals ever fail to find sufficient evidence, like their peers in the non-digital world?

Sure, but removing all traces is hard and most criminals are careless, sloppy or dumb.

I mean, if this particular case is real, someone has performed a serious crime, risking years in jail, for a comparably trivial reason and small gain - it's not an indication that the perpetrator is likely to be risk-averse, meticulous and smart.

If we were looking at a forged email as a part of a sophisticated campaign for extracting secret information or defrauding very large amounts of money, then it would be likely that the forgery is done carefully by skilled people thoroughly removing all traces - but for a reason like this? not likely. Heck, digital "intelligence ops" by major governments sometimes leave traces due to some sloppiness or carelessness, it's very hard to be sufficiently thorough.

How does one prove that he/she didn't sign a paper document that has as signature looking like yours?

You don't, that's up to the police, prosecutors and forensics experts to handle.

Most suspicious to me is if I really wanted help, like this purports to, I'd be following up all the replies for more information avidly.

If the poster didn't really send these e-mails/IMs/communications, this would be a huge fraud, security, workers rights, BS situation. In most situations in IT, directors will pay these types of situations out, mark them as redundancies and move on. I agree. Everything about this story should be examined carefully.

I see a lot of company mail servers misconfigured to allow authenticated users send mail as anyone. So while the SQL part makes no sense to me, sending mails for another account seems rather widespread whereever I .. tested. And then there's of course the ability to just send from your account and change only the FROM header.

Your can send mail from SQL a simple form and a suitable SPROC - I have done this from Oracle back in the day

Would be interesting indeed to know what kind of set up they are using that emails are stored in SQL and don't specifically go for example through postfix/exim where it can be easily detected by logs. Or why they are not using gmail/exchange.

It also makes no sense that HR would not have called him and/or his emergency contact in all that time once they were informed of his decision.

Alternatively (if it's not a complete fabrication - which I agree is most likely).

The author implies that he's used the 'SQL' way of sending emails. Calling it 'SQL' sounds like a way of feigning ignorance of the details - and therefore giving a defense on future cross-examination.

I suspect he either used it personally to resign, or asked a colleague to, who has effectively been set up.

I also thought this seemed fake when I read it. Just a gut feeling though.

Plus, how could they have found and hired a replacement in just 6 weeks?

For what it's worth, my parents asked me to replace one of their contracting engineers who had just resigned. I started working for them the next day. Obviously hiring contractors is different from permanent employees, but if you have the right connections, you can fill a position quickly enough.

Your parents didn't have to search for very long, and you happened to be available. Both of these circumstances are quite unusual.

He doesn't specify what country or what position he held - if it was a low-skill position then that's more than enough time for some areas

You don't even need to poke specific holes in this story. It's an internet story, so if it smells like bullshit it probably is.

Apply Occam's Razor to it. What's more likely; that some unknown person resigned on this guy's behalf or that he resigned and he's going with this b.s. story to save face or that none of this happened? One of the latter two is the most likely.

It's a pile of baloney.

I don't understand your application of Occam's razor. In what way is the scenario that he resigned by accident more likely? Maybe he was drunk, angry, depressed and overwhelmed and sent an email later to change his mind but then... why write about it on stackexchange? Or assuming none of it's true, again why bother writing it up and pretending a fake story?

It's fine to say "this is the internet and people invent stories" but to apply Occam's razor you need to actually come up with a motivation that would cause this guy to actually invent this story and post it online.

I don't feel like I need to explain his motive for posting on SE since the original story doesn't address it either (since he's already fired and seems to have given up. Why is he posting is still an open question even if you believe the original story.)

Why he chose to post is a separate issue. People have any number of motives for doing things, and what you believe to be reasonable explanations depends on how you think about human psychology. Personally I have seen enough people post lies online that I don't even worry about what the motives are anymore. I just look at what I think is more likely; is this story true or not? This story reeks to me. There's no way some unknown person resigned for him. Either he did it and regretted it or this whole story is made up. Both of those are way simpler than the claim that some unknown person logged into his secure email and that the company reacted so nonchalantly to him telling them he didn't do it. If someone hated him enough to write a fake resignation letter and risk their own career like that, he would know who it was.

Frankly it's one of the more obvious fake stories on HN in a while.

Ok, if you don't have an possible explanation for his motivation, that's fine. You are entitled to and should rely on your gut instinct because after all no one here has the complete story.

I think you should be careful to invoke Occam's razor like this though. It states: "Among competing hypotheses, the one with the fewest assumptions should be selected". You can't compare two hypotheses unless you express all of their respective assumptions.