Hacker News Reader

Comment by coldpie | Hacker News Reader

I'm frequently impressed with spammer ingenuity. We had a similar thing happen at a previous job. Users could sign up for a free trial for our software using a web form. The form had fields like "email address" and "name" so we could follow up with the user. Scammers would fill in a victim's email address and some scummy website in the "name" field, resulting in our servers sending the victim an email starting with something like, "Hello, Click Here For Free Money FreeMoney.com," followed by the rest of our marketing copy. Never would've thought to use the form that way...

View on HN

It doesn't help that dark patterns used by well known websites normalizing the problems. That other day I got a credit card charge notification of $154 from my bank about a charge from Amazon. I didn't buy anything from Amazon recently. I also didn't get any email from Amazon about a bill or a purchase. Logged on to Amazon, looked through the order history, looked through AWS billing, and didn't see any recent charges. I thought my card was stolen and got a fraudulent charge.

By chance I looked into the Prime membership page. An obscure page listed the recent Prime charges. Yep, it's the Prime membership charge. The amount looked odd because tax was added to it, where the old charges were like $119 or $139. Amazon employs a dark pattern of not sending to the users any notification on the Prime renewal, no billing statement, no invoice, no email, just a silent charge on the credit card.

I promptly canceled my Prime membership, not for the money but for not rewarding dark pattern behaviors.

That Prime silent charge problem is also problematic after credit card changes and other adjustments.

Saw the other day a charge get refused on a credit card I cancelled. 3DSecure is mandatory on it, so I kinda panicked thinking I got phished somewhere, but no, it was just Amazon reusing their authorization to charge a year later. I would have actually updated my info if I had a heads up, but now that my membership has been canceled following the charge refusal, it's kind of an occasion to let it go.

>I promptly canceled my Prime membership, not for the money but for not rewarding dark pattern behaviors.

Lucky you who was able to get through the dark patterns in the unsubscribe page. I got one extra charge because the first time I tried, I fell for one of their dark patterns and believed it was canceled while it wasn't.

Oh yeah. The unsubscribe page is a minefield of dark patterns, with innocent links leading to continuing the membership. I was pissed enough by then to pay extra attention to get rid of it.

I've had similar experiences where I got charged by amazon for Prime & wasn't sure what it was. They certainly make it hard to find your payment history for Prime renewal.

This just happened to me for a pre-ordered book! I feel so validated. Had to click into the orders.

I wont ever subscribe to Prime again because of their awful UX in trying to cancel.

I gave up and blocked it through my bank and the customer service rep said she had to do the same thing. She also said Amazon will blacklist my credit card ... ummm i dont care I dont and will never subscribe again. Just use a friend or family's account and pick it up from them.

Amazon is stupid for pulling these anti-consumer tricks .. all about bottom line now vs. the future. Stupid!!

Due to a recent regulations regarding subscription payment in India, Amazon cannot charge our payment instrument on file directly for subscriptions; It has to go through an intermediate (payment gateway) and the Bank with explicit permission during initial subscription.

Before each subscription payment there after, The Bank reminds us with SMS about the payment and we can cancel it through that. For amount > INR 5000 (~ 60$) each subscription payment has to be approved by the consumer.

Amazon still does employ dark patterns, Like having 'Prime membership cancellation' behind several pages and the final confirmation located in a non-prominent location; But Indians can cancel Prime membership without even visiting Amazon's website.

I cancelled my Prime for exactly the same reasons.

I don’t think Amazon would be viable today if they dropped their dark patterns and held vendors accountable.

I am at a point where I’d rather go shop at a physical Walmart or Target than buy something from Amazon.com. Driving to a physical store causes me less frustration in 2022.

In the UK (and plenty of other countries, I'm sure) I get a notification for every payment from my banking app and/or Google Wallet (usually both, since I use GPay a lot).

I run a SaaS where users can create projects and invite other users into their projects. When a user gets invited, the SaaS them an email notification "You've been invited to project such-and-such".

So a spammer created a project, they put their spam message in the project's name, and started to go through their victim list, inviting each into their project. I suppose that's one way to send an email :-)

With SPF/DKIM enabling authenticated email, domain reputation is at a premium these days, especially if scammers want to end up in gmail inboxes.

Most spam I get to my gmail inbox nowadays is itself from an @gmail.com address :-/

Indeed. Nearly 100% of the phishing we get at my employer (which I monitor) is from gmail.com addresses.

It's because Mike Hearn retired from the Google anti-abuse team - their bot protections went downhill from there, and now bulk Google accounts sell for a few cents each.

It's easy to make money when you can send out thousands of spam emails, each with hundreds of recipients, for under a cent.

And where do those bulk Google accounts come from? Compromised accounts due to weak/leaked passwords, without 2FA.

What does Google do about them? Making it harder to log in to dormant accounts from new devices and locations. What's the result? Periodic HN complaints on someone unable to access their decade-old dormant account, or an active account with a truly forgotten password, etc.

Anti-abuse is hard. Damned if you do something, damned if you don't.

They could do far more things to solve this issue...

For dormant account reactivation, they can ask the user for lots of details that are in the account. For example, "please type in email addresses of as many people as possible that you have sent emails to from this account". Which cities have you previously logged into this account from?

All info would be optional, but the more the user provides the quicker they're going to get in.

When the user has provided enough information to be fairly sure that it's a real user attempting to login, then start a 7 day countdown. During the 7 days, contact the users top contacted email addresses and ask them to reply confirming the user is trying to reactivate the account.

Hire attackers to try and break into old accounts, and use their input to find the likelihood of each type of information being correctly given by the real account owner and an attacker.

God no. I don't think you've thought of the edge cases at all. I have a 2nd email address I use for emergencies and almost never log in, but when I need it, I'm going to need it straight away, not in a week.

Also, gmail should never ever by emailing your contacts! It has no idea what your relationship with them is or what information about your actions you want to keep secret from them.

> For dormant account reactivation, they can ask the user for lots of details that are in the account. For example, "please type in email addresses of as many people as possible that you have sent emails to from this account".

Oh. no. I'd rather they just up an deleted the account, instead.

Google is already painful enough to get into old accounts that you haven't used for a while.

For a dormant account, what's the chances that you're going to remember the email address that someone used years ago? People have address books for that, and the address book is locked on the other side of that password prompt.

> During the 7 days, contact the users top contacted email addresses and ask them to reply confirming the user is trying to reactivate the account.

Yeah, nah. That's awful for several reasons.

It's another phishing-like prompt - "Hey joe bloggs is trying to log into their email. Do you think it's really them? Click here to let them into their account".

If you invert it, then you're at risk of someone with a grudge against you clicking the "No, it's an attacker" link. Even a friend clicking it because they think it's funny.

There's no way I'd want most of the people I email to have any involvement in accessing my account, without me being able to nominate specifically whom the system emailed.

Have you ever tried to recover an old google account? They ask much harder questions than the silly examples you gave. It’s already extremely difficult for legitimate users.

Back in the day, when online banking used printed TAN-lists as a second factor, phishing sites would ask "Please type in your next 10 TANs". That is what your "please type in as many"-idea reminds me of. :-)

> Making it harder to log in to dormant accounts from new devices and locations.

There is no justification in making it difficult to log in to accounts that have never sent spam, that's the user-hostile part of gmail. They have it in their logs which accounts are sending spam.

When an attacker gets into a dormant account and sends spam, it's because they have already mined all the data in that account... Ie. they've already taken over every account that used that account for password resets, they've already stolen any credit card numbers they could find in the drafts folder or pictures of driving licenses and passports that were uploaded to Google Photos...

Sending spam is the last step... The steps beforehand are much more damaging to the user involved. And, sure, you could blame them for reusing their login password, but not being well versed on computer security isn't widespread, nor a reason to punish them.

> nor a reason to punish them

Locking people out of their account (which sometimes means a large chunk of their real life) with no recourse is very punishing and inexcusable.

And Facebook, for some reason. Which is weird as I've never signed up for any Facebook owned service. Never looked into how they do it, but they keep coming.

I had a form like that. You put in your email and it sends an email from us@foo.com, to us@foo.com, and to them@whatever.com. We had internal mailing lists for clients, including something like all-clients@foo.com, but they were locked down so only certain people could send to them. Turns out us@foo.com was one of those people, and so someone would spam all of our clients by putting their return address as all-clients@us.com. We just took the form down and posted our email address.

Alternatively don't accept any internal @foo.com email addresses in your contact us form unless you're an email provider would work too.

Have you ever seen anyone do that though?

The only real solution is not allowing contact form emails to be customized with free text input.

I guess you could have a manual approval loop for "weird" names (more than 30 characters, has a dot in it, etc) or other signs of spam. It would still leave some space for spamming though (I can't imaging a rule that stops "Buy More ETH" but doesn't stop any unusual real name).

> Have you ever seen anyone do that though?

I don't know I haven't really probed random contact forms to see if they block this kind of thing.

There's a lot more to do to block this kind of proxy spam entirely for sure I was just talking about the particular problem of using the contact for to send to an mailing list.

It's definitely evil genius stuff.

I'm sure enough organizations have a mailing list called "customers@company" or "clients@company" to make it worth a shot. Colleges probably have "students@school" or "faculty@school" list.

Might be enough names you can profitably do it by hand.

How did they know the internal mailing list address was all-clients@us.com? Unless I'm missing something, sounds like this would require internal company knowledge.

Maybe the spammer used to be a client and the internal mailing list name got leaked through an email they got.

Add me to the chorus of people that are impressed/scared by spammers.

In a previous life, I worked at a semi-well-known auto publisher site where scammers literally stood up a copy of almost _the entire site_ (ads, functionality, and all) in order to execute an auto escrow scam. We know of at least one instance where a user in the UK was scammed out of ~$10,000-ish using this method.

Democratization of technology at its best (worst?) I guess...

Never trust user input. If a user input value will be used on a page or email or other output, it will be abused once this is discovered. You must sanity check.

Edit: this was already pointed out downthread. Missed it before I posted.

The fact that in 2022 user input sanitation is still such a low hanging fruit for attackers shows that you cannot preach this loud enough or often enough.

As someone with the unfortunate privilege of having an early GMail address with ${FIRST_NAME}.${LAST_NAME}@gmail.com, the fact that your description of the first email you would send your ostensible customers does not sound like a straightforward confirmation email is already a red flag.

I don't think it's unreasonable for even a confirmation email to address the user by their chosen name, but yeah, I guess you're right. This is why we can't have nice things :(

Power of incentives at play.

e.g. this (and many others) AMA on Reddit [0]

[0]: https://www.reddit.com/r/IAmA/comments/9dw73/i_am_a_spammer_...

Another pain in the ass one is creating google docs and sharing them, gets past spam.

Reply on news.ycombinator.com