Hacker News Reader

Comment by karim79 | Hacker News Reader

Here's an amazing study from Microsoft which I recall from back in the day (PDF):

https://www.microsoft.com/en-us/research/wp-content/uploads/...

Edit: Recalled -> Recall

This paper is the one and only source for every claim from the past 10 years that "scammers make mistakes in scams on purpose." Crucially, no actual scammer or former scammer or even acquaintance of a former scammer has ever corroborated it. The paper itself is pure speculation.

If anything I think that paper serves best as a reminder that just because an idea is clever and logical, that doesn't necessarily mean it's true.[1]

[1] As another example, see https://en.wikipedia.org/wiki/Nuclear_Gandhi

No. The paper is about reducing a set, as far as I understand. It's not about mistakes. It's about the deliberacy of basically squeezing out the individuals who are vulnerable and who do not see the signs of being scammed.

Yes but ascribing those motivations is a guess. There's no actual scammer saying they are doing that vs. it just being a fairly unsophisticated scam. It might be the reason, but the paper provides no actual proof, and as far as I've been able to find, neither has anyone else in the decade since. Just a whole lot of people repeating the theory as fact.

I'll take your point and rabbit hole it a bit sir.

If you find actual proof - even a friend of a friend saying they once heard it from a real scammer - I'd love to see it.

I used to bait 419 scammers. Weirdly enough I actually befriended a couple of them. That was about 20 years ago. They were full on and shameless but when exposed they became more human and even sympathetic and I dropped my guard and told them what I was doing.

One of them said, and I'll never forget, "Thank you for being reasonable".

I had a friend who had a similar experience with a dating site scammer. The guy dropped the act and admitted he was operating out of Africa (I forget the country) and was not proud of what he was doing but did so out of desperation. He told my friend of his living situation, rampant poverty of his country and little to no hope of a future. That small conversation stuck with my friend.

The stuff does stick because it's literally connecting with humans who are hard done by and it's always affecting. It's really sad.

It's more sad to me that it's usually just a second layer to the scam. People's empathy can be exploited just as easily if not more so than their intellect.

> By sending an email that repels all but the most gullible the scammer gets the most promising marks to self-select, and tilts the true to false positive ratio in his favor.

There's less need to identify the most gullible when AI drops the incremental cost of responding closer to zero.

And, it also allows for more advanced, labour intensive, targeted styles of attacks to be leveled at targets much less promising.

I had a bash with that paper. It is pure and utter tosh - I started with the ... start and swiftly moved to 6. Conclusion.

"Thinking like an attacker is a skill rightly valued among defenders."

and

"Attacking as a business must identify targets, and this is easy only if we believe that attackers have solved a problem that has vexed multiple communities for decades."

Bollocks!

How so? For me the point of the paper is the elimination of the ones who will not fall for such a scam in the first place. The title of the paper says it all.

Are we talking about the same thing?

Bash = tried Tosh = nonsense Bollocks = also nonsense

Fair enough man. I didn't write the paper no need to hate on me sir.

(Parent’s helpfully defining the Britishisms for HN readers)

As a British person I find this to be very very British.

I like them, I just didn't understand them and figured I'd educate the crowd so we can all join in and call things tosh. Posh = fancy, tosh = bad.

Don't forget to check out: "bosh", "cosh", "dosh", "gosh", "josh", "mosh", and "nosh" too! ;)

Sorry were they Englishisms or something, almost clarified I didn’t know!

Reply on news.ycombinator.com