Hacker News Reader

Comment by vegannet | Hacker News Reader

Any organisation where “hey I forgot my password, can you reset it?” from an unknown email address is an attack that has chance of success is an organisation where there’s dozens of major problems long before you get to auto-responders identifying who is away from the office.

View on HN

You're assuming I can't hop on the phone (appearing to come from a known number using Caller ID spoofing, using LinkedIn to get a general idea of the org chart) and bluff my way through it with your underpaid, overworked help desk staff. People are the weakest link.

This is only a few steps above Indian scammers taking remote control of users’ computers and convincing those users to send them hundreds of dollars of gift cards to prevent legal action by the IRS. Consider your average user, not the HN participant.

https://www.youtube.com/watch?v=YVqurfWzB-Q (Hacking Humans : Social Engineering Techniques and How to Protect Against Them - Stephen Haunts)

We are arguing different points. I’m saying _if_ an organisation _is_ insecure enough for social engineering to work then a vacation auto-responder is not going to represent any meaningful increase in risk.

I am arguing that _most_ organizations are insecure enough for social engineering to work, and that autoresponders are yet another vector. Orgs that observe proper operational security are still a minority.

Yes, we know what you are arguing. And if auto-responders are yet another vector for an org, then it does not represent a meaningful increase in risk.

Reply on news.ycombinator.com