Hacker News Reader

Comment by ryanSrich | Hacker News Reader

I wonder if phishing simulations are allowed. There's nothing explicit in the code of conduct (at least none that I could find with a quick search). Smishing sims are a great way to train staff on phishing, and disallowing them would be somewhat antithetical to their explicit mission here of protecting they users.

View on HN

Does it really make anyone safer? I’d think that time would be better spent deploying WebAuthn so phishing is impossible, and working vendors to reduce the number of legitimate messages which are indistinguishable from phishing.

At least for the company I work for, to maintain our insurance, we had to be enrolled in a service (KnowBe4) that does nothing but:

1) produce shitty AI voiceover "please don't click email links" videos

2) randomly email, text, etc us with fake stuff trying to get you to click the links.

I always report the emails as phishing to Google just hoping one day something gets flagged somewhere on Google's side, but I doubt it will ever happen.

No one is making you use Knowbe4. As someone that founded a company in this space, the amount of people that hate SAT and Phishing sims purely based on their experience with certain companies is tremendous.

> No one is making you use Knowbe4.

My company is, but that's me being pedantic.

What I meant "we had to be enrolled in a service" in the "any company that provides this service" and was just giving the current company as an example.

Training and simulations absolutely do reduce the likelihood of an event.

Most companies don't use these tools correctly, and certainly the technical audience here on HN will despise them. But phishing simulations can reduce your risk.

Is there any solid research published on that? The anecdotal evidence I’ve heard from people at pretty large companies was that it only helped with a modest reduction the lowest-skill phishing, whereas actually securing their systems had far more impact.

Reply on news.ycombinator.com