Comment by hn_throwaway_99 | Hacker News Reader

Comment by hn_throwaway_99 | Hacker News Reader

Parent Full thread

hn_throwaway_99

> Forging a judicial order is trivial.

That's like saying forging a plea from a Nigerian prince is trivial. Verizon should be deeply embarrassed by this - I mean the initial request came from a proton account with misspellings and grammar mistakes of a child.

I don't know how Verizon does it, but I have a friend who works in the "respond-to-law-enforcement department" at one of the FAANGs. Given the company, they get tons of legal requests for info, but also tons of fraudulent ones, not to mention ones from real governmental organizations but that are dubious that they challenge. Point being they have extremely detailed processes and technology to respond to these requests. Verizon is the biggest cell phone company in the US, they can afford to not look like a total clown show in this regard.

> Verizon should be deeply embarrassed by this

Companies have no feelings, only pockets.

Make carelessness expensive enough and they will care.

> I mean the initial request came from a proton account with misspellings and grammar mistakes of a child.

Many phishing attempts are shockingly bad like this - but that doesn't make it difficult to not have mispellings and grammar mistakes and come from a vaguely plausible domain (gmail?). If your defense against phishing relies on your adversary not knowing what a legitimate request looks like - it's not a very good defense.

Two points:

"Normal" phishing is a bad example, because many phishing emails notoriously use misspellings and bad grammar on purpose because scammers don't want to waste their time on people with half a brain, they only want people dumb enough to respond in spite of the ludicrous misspellings. But in this Verizon case, that logic doesn't apply, because there was only a single targeted recipient.

With respect to "If your defense against phishing relies on your adversary not knowing what a legitimate request looks like - it's not a very good defense", I wholeheartedly agree. My point was only that the fact that Verizon responded to this fake subpoena despite the reddest of red flags makes me think that they must have horrible procedures generally for verifying these types of requests.

Reply on news.ycombinator.com