Hacker News Reader

Comment by rlpb | Hacker News Reader

How do they know that you can be trusted, and aren't just another spammer/phisher?

You and I can tell the difference, but to the sort of people who run vulnerable servers, perhaps a legitimate email about server security looks indistinguishable from the others ("Hi I'm from Microsoft technical support. Please let me in to your computer to help you fix it").

View on HN

What I do in my emails is tell them the exact URL of the bad page. All they need to do is look at the file with a text editor (they are admins, after all). Once they have done this, they will see strange Javascript. They will know it has nothing to do with their own (or their clients) web pages. There are no links per se in my email (except the URL, but I leave off the http:).

Don't you worry that if you email spammy/virus-laden links then your email address could get flagged?

Perhaps using a dedicated email for these sorts of reports could limit the damage if that were to happen. It would probably increase the chance of being flagged, though.

I've worked as a security analyst at a company and sometimes I would report phishing pages to the webhost. After a while, I realized that half of my emails were being silently quarantined by the company's outbound spam filters due to the included URLs. I was able to manually release them, but I wonder how many emails will then be flagged on the receiving end.

Typically when sending an email with content like that for a notification you'll "defang" the URL by rendering it like "hXXp:// foo (dot) bar (dot) com" or something along those lines to ensure that it isn't automatically flagged and filtered, though it's also common on the receiving end to apply no spam filters to their abuse@ email as well. You'll usually have better luck sending this information to the abuse email listed in the IP whois than to any contact information at the domain itself.

> you'll "defang" the URL

Wow, that's a phrase I haven't heard in ages.

This is the business: https://en.wikipedia.org/wiki/MIMEDefang

Most site admins aren't really aware/in-charge of the javascript on their pages.

Most webmaster@ or admin@ e-mails aren't monitored at all, or so flooded with spam that it's easy for things to get lost.

I don't think you need to trust the sender of the email. If someone emails me and there is a link to mywebsite.com and I click and it looks like the Google login page, I am going to be super alarmed and take the necessary action. Maybe they are out to get me (they hacked my website and put malware there), but if it's my own website that gets me, that's on me.

> How do they know that you can be trusted, and aren't just another spammer/phisher?

That's not it, not all of the time anyway.

Over the summer I discovered a third party mail server with a missing DNS entry. It was like that for months and all their mail was getting flagged as spam.

I sent them an email (from an account that wasn't flagging their mail as spam) pointing it out. They fixed it within 24 hours but I never got a single reply.

They wouldn't trust the sender they would assign a dev to inspect the referenced file, decision making would start at that point.

The dev got his $99 two years ago and had long since taken up other contracts.

Reply on news.ycombinator.com