Hacker News Reader

Comment by orange_tee | Hacker News Reader

Email addresses can be spoofed.

https://en.wikipedia.org/wiki/Email_spoofing

Well, of course, SMTP headers are trivial to spoof, but for this scam to work, the scammer would need actual POP/IMAP access to the harvard.edu account to receive her replies and respond to those, which is not as trivial.

No. [1][2][3]

[1] https://en.wikipedia.org/wiki/Sender_Policy_Framework

[2] https://en.wikipedia.org/wiki/DMARC

[3] https://en.wikipedia.org/wiki/DomainKeys_Identified_Mail

Only if they’re used. There are no DMARC records in place for harvard.edu or subdomains, which is kinda shocking.

The lack of DMARC records, even if it could facilitate spoofing, won’t magically make reply emails addressed at a valid @harvard.edu address land in a spoofer’s inbox. A different Reply-To address is possible but then you can’t claim a lack of warning signal. There’s something else going on.

I'm guessing the scammers did something like person@hr.harvard.edu.obscuredomain.tld

They've gotten pretty good at crafting domains this way.

No idea on harvard, but alumni are often allowed to keep their addresses and for every alum that still takes full advantage of that, ten may not notice anything. Similarly, old group addresses may mostly go into the void.

I suspect it is quite easy to make it look like many people from an institution are in a thread and a passive participant is an email address from a 3rd party job portal.

I don’t know a single reputable U.S. institution that doesn’t replace your @university.edu address with @alum[ni].university.edu after you leave. I’ve been affiliated with two and have friends all over the place, including Harvard.

MIT is right next to Harvard..

*Might your own cultural expectations open you to attacks from a place with MIT's (recent if not current) network culture?

MIT uses @alum.mit.edu. I don’t think I know former employees there but at least former students I know lose mit.edu addresses, a fact also easily confirmed with a Google search. So, your point being?

Edit: You added

> *Might your own cultural expectations open you to attacks from a place with MIT's (recent if not current) network culture?

after my reply. I’m not sure how it is relevant to your claim that “alumni are often allowed to keep their addresses”. In fact the question doesn’t make any sense to me; I’m not gonna accept an MIT job offer from an alum.mit.edu address (or more relevant to me, alumni.stanford.edu/alumni.princeton.edu), regardless of network culture.

Edit 2: Reread your question and realized you were implying that MIT "recently" allowed alumni to keep @mit.edu addresses. Well, you'll need to show some proof.

Your expectations are very specific to what you know about US schools right now. MIT would let a machine receive email, many institutions would forward email to a users alum address, etc.

This approach to identifying phishing is ultimately insufficient.

For decades, Harvard issued alumni email addresses of *@post.harvard.edu. [1] Given that “post” could either refer to “after” or “postal”, I would imagine someone who didn’t know many people at Harvard might think that a post.harvard.edu email address is a normal thing for current employees.

1: https://alumni.harvard.edu/help/email-forwarding

My alma mater (one of the highest ranked state schools) grants your email for live and does not update it.

Berkeley doesn't.

Reply on news.ycombinator.com