Hacker News Reader

Comment by saagarjha | Hacker News Reader

The issue with solving this problem is the incentives are mostly "how can we get Google/Apple/Microsoft/Facebook users to not get phished" since they are the strongest voices in the room when this kind of thing happens, but then half the time we get solutions like "what if we pre-registered a list of 'popular' companies and flagged everything else" which of course hurts everyone that doesn't make the list. And the other half of the time you get "what if we kept a 'bad list' of websites people should't go to" and you have the constant issue of scammers staying one step ahead of these things and/or benign websites being flagged. There still doesn't seem to be a good way to have people associate their identity with a domain on the web.

View on HN

Just like in real life, I think the answer is not prevention but accountability. The only thing stopping a random person from bashing in my head on the sidewalk (besides moral decency) is their understanding of the consequences. They can do it, but they'll go to jail for a long, long time.

Similarly, the answer on the net is not to stop bad actors from being bad. It's to punish and hold accountable those that do bad things. That avoids the "thoughtcrime" problem, and makes space for actual freedom.

The only thing we have to lose is privacy for domain owners. Seems like a trade-off worth considering.

Hopefully the consequences are not the only thing.

It seems like consequences are the only language that bad actors understand, unfortunately.

I think you're supposed to read "a random person" as "any random malicious person".

What prevents the violent psychopath from killing the child they see to get their lollipop when they want something sweet? The fact that there are repercussions. What prevents those that have no qualms about stealing from a store from doing so most of the time (even those that steal don't do it every time they enter a store)? The same.

Besides moral decency, I said. What else do you think there is?

A lot of phishing, and other online financial crime, is perpetrated by groups operating with the support of their home governments. There's no way to hold North Korean state-backed phishing/criminal hacking groups accountable without disconnecting North Korea from the Internet or going to war with them. Similar issues apply to curtailing online crime committed by Russian mafia entities, as they are well connected to the Russian government.

An alternative strategy would be to crack down on the money laundering channels used by criminal entities to get money from their victims, but this would be politically difficult as it would involve shutting down grey-market banks that are well used by the ultra wealthy to evade taxes and pay bribes.

Seems like something functioning governments should be able to resolve with extradition treaties, and sanctions for those who do not abide by them.

North Korea is already under severe economic sanctions for its nuclear weapons program and other geopolitical issues[0]. Russia is also under economic sanctions for invading Ukraine. There's very little the rest of the world can do to hold either of them accountable for sanctioning organized fraud groups in their territories.

Are there any sources for this? I'm not saying what you're saying is true, but I have a hard time believing the majority of scams and spam out there is state-sponsored as opposed to independent bad actors, and if accountability can at least weed those out then that's still a win.

North Korean state-sponsored criminal fraud activities:

https://www.zdnet.com/article/north-korea-s-apt38-hacking-gr...

https://www.cnn.com/2019/03/01/politics/north-korea-cyberatt...

Connections between specific Russian financial crime organizations and the Russian government are much harder to pin down as people who try to investigate ties between the Russian mob and the Russian government often wind up dead. However, the Russian government is well known to be tightly linked connected to Russian organized crime[0]. Given the sheer scale of Russian financial fraud operations--Carbanak stole upwards of a billion USD[1]--the balance of probabilities suggest these operations exist with the tacit approval of the Russian government.

[0] https://bpr.berkeley.edu/2019/12/16/gangs-and-gulags-how-vla...

[1] https://securityintelligence.com/carbanak-how-would-you-have...

> The only thing we have to lose is privacy for domain owners.

This is a huge downside. Anonymous publishing is a very important right.

Must speech be anonymous to be free?

Yes. That’s why voter anonymity is so important, for example.

I would posit that for normal run-of-the-mill communications, anonymity is overrated. What is this edge case of politically sensitive communications that you think is at risk?

I lose my job for supporting the wrong candidate?

Most HNers here including yourself are writing comments with the comfort of anonymity. I don't want to worry about anything I have to say being tied to my identity, whether it's even my thoughts that there's nothing wrong with a "master" branch much less my much more unsavory thoughts in the tech space.

Isn't it possible that people become more comfortable attacking common sense opinions like that because they are only expressed in pseudonymity? If the veil were lifted, we'd all have to stand behind our opinions, and people who wanted to disagree would have to do it to our faces. Maybe removing humanity from the internet is not the panacea it seems?

What isn’t “politically sensitive”?

If you create a git repo, the first branch’s name is a controversial political issue.

“Everything’s political” ~ What’s-his-face the communist in Fiddler on the Roof after introducing “Will you marry me?” as “a political question.”

Yes. Think of countries with a mandatory "impressum" (Germany and Austria)

> > The only thing we have to lose is privacy for domain owners.

> This is a huge downside. Anonymous publishing is a very important right.

It also wouldn't work. Or rather, at best it would only work as well as political campaign message attribution does (and that's with considerable enforcement muscle aimed at it).

Somehow "dark money" often manages to evade these efforts, and evade the consequences of violations, and I wouldn't expect transnational phishing and scams to be any different.

Which isn't to say that we should stop trying, but sacrificing the capability of the general public for anonymous speech in return for dubious-at-best attribution by well-heeled actors seems like a poor tradeoff.

Reply on news.ycombinator.com