Hacker News Reader

Hacker News

Comment by busterarm | Hacker News Reader

Full thread

busterarm

Repeat after me:

Everyone can be spearphished.

I mean it. Everyone.

View on HN

A favorite example of mine even if it's contrived: https://twitter.com/sc00bzt/status/730903007014076416

Oh that's funny!

Introducing an attack vector to get arbitrary people fired by policy can't possibly go wrong!

That should be an Internet rule: Don't set up any mechanism that puts severe power in the hands of anonymous strangers. It will get exploited!

My wife has 4 degrees, including a PhD from Stanford. She's working on another one. She got phished at work.

No I can't be spearphished. Prove me wrong.

Since you are making the more extraordinary claim, you need to provide evidence that your computer usage practices are 100% infallible to sophisticated attacks against you by people who know a lot about you.

How do you prove this though? It's the classic "you can't prove a negative" scenario. I have no particular desire to associate this account with my real name or I would post my work email here just to let people try.

No I don't have to do that. The onus isn't on me. I don't know where you came up with such a silly idea.

The historical record of confidence tricks goes back 400 years. Little changes.

There's a con out there for everyone just like there's a lid for every pot.

Oh sure everyone can be vulnerable to certain cons. Fortunately all spear phishing attacks can be very easily avoided through technical means. I guess those who down voted me must be unfamiliar with the functionality available in current enterprise email systems.

That's great. Not all spearphishing comes in via email though. See Dark Caracal or Magic Hound for relevant history here.

Also fraudulent invoices are another form of spearphishing that you'll still have a pretty hard time against.

I don't know, I'm also on the operations side in a large enterprise and I help with our internal phishing efforts. Pretty sure I'm familiar with the same tools that you are and I vehemently disagree with your assessment.

Reply on news.ycombinator.com