Hacker News Reader

I'm sorry but there is no level of user education that will protect a large organisation from phishing links. The attack surface is way too large and safety depends on how the user is feeling on any given day when a random email turns up. There are no high reliability systems that require manual user interaction on a frequent basis especially on low-effort low-concentration tasks.

View on HN

I agree about the insufficiency of user-education.

I think we need go further: what we need to do is kill the idea that email is an good vector for notifications inside of big organizations (or maybe even outside of them). I should have a dedicated app with a whitelist based system that official notifications go through. This could be not only a security improvement, but also a stab at better UX, better productivity, and avoiding notification fatigue.

Reply on news.ycombinator.com