Comments on: How I got phished http://boingboing.net/2010/05/05/how-i-got-phished.html Brain candy for Happy Mutants Fri, 24 May 2013 02:43:00 +0000 hourly 1 http://wordpress.org/?v=3.4.1 By: Anonymous http://boingboing.net/2010/05/05/how-i-got-phished.html#comment-779790 Anonymous Wed, 30 Nov -0001 00:00:00 +0000 #comment-779790 in many cases its not that they get you via shortened URL, a link, an attachment. they get you through lack of attention. In the haste of the day, most people, are barely attentive. Add to that the fact the email was from someone "familiar" so your attention will be even less. in many cases its not that they get you via shortened URL, a link, an attachment. they get you through lack of attention. In the haste of the day, most people, are barely attentive. Add to that the fact the email was from someone “familiar” so your attention will be even less.

]]> By: Anonymous http://boingboing.net/2010/05/05/how-i-got-phished.html#comment-779804 Anonymous Wed, 30 Nov -0001 00:00:00 +0000 #comment-779804 You should follow @spam they warned of the "is this you" phishing attack months and months ago. You should follow @spam they warned of the “is this you” phishing attack months and months ago.

]]> By: standard http://boingboing.net/2010/05/05/how-i-got-phished.html#comment-779809 standard Wed, 30 Nov -0001 00:00:00 +0000 #comment-779809 That's why I only interact with Twitter via Tweetdeck. Click on a shortened URL and you get a popup showing the full address, page title, how many clicks it's gotten, etc. THEN you decide whether to click through. That’s why I only interact with Twitter via Tweetdeck. Click on a shortened URL and you get a popup showing the full address, page title, how many clicks it’s gotten, etc. THEN you decide whether to click through.

]]> By: Lobster http://boingboing.net/2010/05/05/how-i-got-phished.html#comment-779813 Lobster Wed, 30 Nov -0001 00:00:00 +0000 #comment-779813 I got fished on Steam in an almost identical way and felt really bad about it. If it can happen to Cory, though, then maybe it's not so shameful anyway. Or maybe Cory should be horribly ashamed! ;) Thanks for posting this. I got fished on Steam in an almost identical way and felt really bad about it. If it can happen to Cory, though, then maybe it’s not so shameful anyway.

Or maybe Cory should be horribly ashamed! ;)

Thanks for posting this.

]]> By: Notary Sojac http://boingboing.net/2010/05/05/how-i-got-phished.html#comment-779819 Notary Sojac Wed, 30 Nov -0001 00:00:00 +0000 #comment-779819 This is why I don't use any social networking sites. Want to send a message to my PC? It's email or nothing, Bunky. Want to send me a message on my phone (a four year old bare bones Motorola)? It's voice or nothing. I'm that guy the president of Sprint is making the snarky comment about in the commercial. And get off my lawn this instant! This is why I don’t use any social networking sites. Want to send a message to my PC? It’s email or nothing, Bunky.

Want to send me a message on my phone (a four year old bare bones Motorola)? It’s voice or nothing. I’m that guy the president of Sprint is making the snarky comment about in the commercial.

And get off my lawn this instant!

]]> By: sparkdale http://boingboing.net/2010/05/05/how-i-got-phished.html#comment-779834 sparkdale Wed, 30 Nov -0001 00:00:00 +0000 #comment-779834 I guess you could call it "phishing with dynamite." (Sorry.) I guess you could call it “phishing with dynamite.”

(Sorry.)

]]> By: Grey Devil http://boingboing.net/2010/05/05/how-i-got-phished.html#comment-779612 Grey Devil Wed, 30 Nov -0001 00:00:00 +0000 #comment-779612 The shortened URLs that are so prevalent in Twitter and Facebook are exactly the sort of things that keep me from really liking the services. I'm sure there are addons, sites, or whatever that might check these shortened URLs to make sure one doesn't fall victim to a malicious link. But honestly it starts to become a hassle in the long run. Anyways live and learn i suppose, thanks for spreading the word on this. No one is ever really protected when online. The shortened URLs that are so prevalent in Twitter and Facebook are exactly the sort of things that keep me from really liking the services. I’m sure there are addons, sites, or whatever that might check these shortened URLs to make sure one doesn’t fall victim to a malicious link. But honestly it starts to become a hassle in the long run.

Anyways live and learn i suppose, thanks for spreading the word on this. No one is ever really protected when online.

]]> By: Antinous / Moderator http://boingboing.net/2010/05/05/how-i-got-phished.html#comment-779613 Antinous / Moderator Wed, 30 Nov -0001 00:00:00 +0000 #comment-779613 I hate to say 'you told you so', but... http://boingboing.net/2009/04/04/why-url-shorteners-s.html I hate to say ‘you told you so’, but… http://boingboing.net/2009/04/04/why-url-shorteners-s.html

]]> By: Anonymous http://boingboing.net/2010/05/05/how-i-got-phished.html#comment-779614 Anonymous Wed, 30 Nov -0001 00:00:00 +0000 #comment-779614 May not be new info to you, but everyone should know too, I use 1Password on Mac, and there's plenty of other apps around like it for both systems, which stores all my passwords for my computer browser OR on my iPhone (the later of which is browser based using javascript so I imagine has some compatibility with things like the Nexus One et al) and it's saved my ass a few times as it runs off a master password. If I need to login to a page, I hit a quick key which brings up my master password prompt, I enter it in and whammy, inserts my details (or brings up a drop down if I have multiple accounts for that domain) and then logs me in. Because it runs off the domain, it doesn't work in the event of phishing and has stopped me from logging in to 4 or 5 pages made to look identical to various sites I use eg: Twitter, Gmail etc. I can't remember the cost of it but it's worth it's wait in GOLD and I insist anyone who uses a computer more than 30 mins a day use something like it. May not be new info to you, but everyone should know too, I use 1Password on Mac, and there’s plenty of other apps around like it for both systems, which stores all my passwords for my computer browser OR on my iPhone (the later of which is browser based using javascript so I imagine has some compatibility with things like the Nexus One et al) and it’s saved my ass a few times as it runs off a master password. If I need to login to a page, I hit a quick key which brings up my master password prompt, I enter it in and whammy, inserts my details (or brings up a drop down if I have multiple accounts for that domain) and then logs me in. Because it runs off the domain, it doesn’t work in the event of phishing and has stopped me from logging in to 4 or 5 pages made to look identical to various sites I use eg: Twitter, Gmail etc. I can’t remember the cost of it but it’s worth it’s wait in GOLD and I insist anyone who uses a computer more than 30 mins a day use something like it.

]]> By: funkadelic73 http://boingboing.net/2010/05/05/how-i-got-phished.html#comment-779870 funkadelic73 Wed, 30 Nov -0001 00:00:00 +0000 #comment-779870 PWNED. PWNED.

]]> By: tzaraat http://boingboing.net/2010/05/05/how-i-got-phished.html#comment-779617 tzaraat Wed, 30 Nov -0001 00:00:00 +0000 #comment-779617 For me, Locusmag.com 's website is currently timing out with a 503 error. You can get to the article via google's cache thusly: http://webcache.googleusercontent.com/search?q=cache:http://www.locusmag.com/Perspectives/2010/05/cory-doctorow-persistence-pays-parasites/ For me, Locusmag.com ‘s website is currently timing out with a 503 error.

You can get to the article via google’s cache thusly: http://webcache.googleusercontent.com/search?q=cache:http://www.locusmag.com/Perspectives/2010/05/cory-doctorow-persistence-pays-parasites/

]]> By: DonBoy http://boingboing.net/2010/05/05/how-i-got-phished.html#comment-779873 DonBoy Wed, 30 Nov -0001 00:00:00 +0000 #comment-779873 I note that the link in comment #2 -- which is only 13 months old -- has someone asking sincerely "Wait, what's 'twitter'?" I note that the link in comment #2 — which is only 13 months old — has someone asking sincerely “Wait, what’s ‘twitter’?”

]]> By: watchout5 http://boingboing.net/2010/05/05/how-i-got-phished.html#comment-779623 watchout5 Wed, 30 Nov -0001 00:00:00 +0000 #comment-779623 hey thanks for that, I was getting the same error hey thanks for that, I was getting the same error

]]> By: Paul Turnbull http://boingboing.net/2010/05/05/how-i-got-phished.html#comment-779627 Paul Turnbull Wed, 30 Nov -0001 00:00:00 +0000 #comment-779627 Funny I just watched SE2EP4 of Castle: "Fool Me Once", tonight. The social engineered phish is the Internet grift. We can spend hours and days hardening our systems but the real cons go for the weak link: the human at the centre of the system. I make sure all my passwords are different so that when I eventually screw up (and I will), the damage is limited. Do your best to eliminate the single point failures and the hacker will find they didn't really get much at all. Funny I just watched SE2EP4 of Castle: “Fool Me Once”, tonight. The social engineered phish is the Internet grift. We can spend hours and days hardening our systems but the real cons go for the weak link: the human at the centre of the system.

I make sure all my passwords are different so that when I eventually screw up (and I will), the damage is limited. Do your best to eliminate the single point failures and the hacker will find they didn’t really get much at all.

]]> By: theLadyfingers http://boingboing.net/2010/05/05/how-i-got-phished.html#comment-779630 theLadyfingers Wed, 30 Nov -0001 00:00:00 +0000 #comment-779630 If I see multiple punctuation marks I ignore immediately and send a message - not a reply - to the person to let them know they are likely the victim of a hack. If I see multiple punctuation marks I ignore immediately and send a message – not a reply – to the person to let them know they are likely the victim of a hack.

]]> By: RebeccaCaroe http://boingboing.net/2010/05/05/how-i-got-phished.html#comment-779637 RebeccaCaroe Wed, 30 Nov -0001 00:00:00 +0000 #comment-779637 TheLadyFingers - that's all very well if you don't have real friends who use that sort of punctuation as a matter of course! LOL. Actually, I don't. But you may do. TheLadyFingers – that’s all very well if you don’t have real friends who use that sort of punctuation as a matter of course! LOL. Actually, I don’t. But you may do.

]]> By: proletariat http://boingboing.net/2010/05/05/how-i-got-phished.html#comment-779638 proletariat Wed, 30 Nov -0001 00:00:00 +0000 #comment-779638 Who the hell uses multiple punctuation marks!?!?!? Who the hell uses multiple punctuation marks!?!?!?

]]> By: Donald Petersen http://boingboing.net/2010/05/05/how-i-got-phished.html#comment-779641 Donald Petersen Wed, 30 Nov -0001 00:00:00 +0000 #comment-779641 Huh. And now the Google cache version is taking a suspiciously long time to load. I bailed. Has someone somewhere taken offense at what Mr Doctorow had to say? Is there some new devilry afoot? Huh. And now the Google cache version is taking a suspiciously long time to load. I bailed.

Has someone somewhere taken offense at what Mr Doctorow had to say? Is there some new devilry afoot?

]]> By: redstarr http://boingboing.net/2010/05/05/how-i-got-phished.html#comment-779900 redstarr Wed, 30 Nov -0001 00:00:00 +0000 #comment-779900 If you use Firefox, there are some add-ons that will show the long version of the links. I use one called "Longer URL please" and it works great. It took only a second or two to install and now I always know where I'm really going to be going when I click on something. If you use Firefox, there are some add-ons that will show the long version of the links. I use one called “Longer URL please” and it works great. It took only a second or two to install and now I always know where I’m really going to be going when I click on something.

]]> By: ADavies http://boingboing.net/2010/05/05/how-i-got-phished.html#comment-779645 ADavies Wed, 30 Nov -0001 00:00:00 +0000 #comment-779645 Funny thing is that I sent you (Cory) an email with almost the exact same subject line, "fact check - is this really you?" after someone claiming to be you posted something to my site. Turned out it was you (thanks for posting). But I bet you get a lot of messages like this. And you're motivated to check them out (you don't want people spoofing your identity). Funny thing is that I sent you (Cory) an email with almost the exact same subject line, “fact check – is this really you?” after someone claiming to be you posted something to my site.

Turned out it was you (thanks for posting). But I bet you get a lot of messages like this. And you’re motivated to check them out (you don’t want people spoofing your identity).

]]> By: bat21 http://boingboing.net/2010/05/05/how-i-got-phished.html#comment-780928 bat21 Wed, 30 Nov -0001 00:00:00 +0000 #comment-780928 Another reason why I hate Twitter. Firefox + Greasemonkey + <a href="http://userscripts.org/scripts/show/40582">TinyURL Decoder</a> = :) Another reason why I hate Twitter.

Firefox + Greasemonkey + TinyURL Decoder = :)

]]> By: Todd Knarr http://boingboing.net/2010/05/05/how-i-got-phished.html#comment-779651 Todd Knarr Wed, 30 Nov -0001 00:00:00 +0000 #comment-779651 I'm not surprised. That's one reason I don't trust URL shorteners at all, nor do I trust login pages unless I used one of *my* bookmarks to get there or typed the URL into the browser myself. And it's been a long time since you could trust messages from people you know more than those from complete strangers (ever since the first viruses started scanning e-mail address books). It's a sad commentary on the state of things when this becomes a realistic evaluation: "The question isn't whether I'm paranoid, it's whether I'm paranoid enough.". I’m not surprised. That’s one reason I don’t trust URL shorteners at all, nor do I trust login pages unless I used one of *my* bookmarks to get there or typed the URL into the browser myself. And it’s been a long time since you could trust messages from people you know more than those from complete strangers (ever since the first viruses started scanning e-mail address books).

It’s a sad commentary on the state of things when this becomes a realistic evaluation: “The question isn’t whether I’m paranoid, it’s whether I’m paranoid enough.”.

]]> By: Zadaz http://boingboing.net/2010/05/05/how-i-got-phished.html#comment-779669 Zadaz Wed, 30 Nov -0001 00:00:00 +0000 #comment-779669 Reminds me of a similar conjunction of events that ended up getting my computer infected with the one virus I ever got. For a brief time I was expecting attached spreadsheets from semi-unknown people (I had put a bid out to a number of companies) I had just changed email clients and didn't quite know how it handled attachments, I had expected it to save attachments when clicking on them rather than opening them. And I was in a hurry. And I had my AV set to update definitions later in the day. (The update that detected that virus was 2 hours late.) Had any one of those things not been true I never would have run the masquerading spreadsheet and got infected. Up until then I thought it would never happen to me. Now I hope it never happens again, but 100% vigilance just isn't possible. Reminds me of a similar conjunction of events that ended up getting my computer infected with the one virus I ever got. For a brief time I was expecting attached spreadsheets from semi-unknown people (I had put a bid out to a number of companies) I had just changed email clients and didn’t quite know how it handled attachments, I had expected it to save attachments when clicking on them rather than opening them. And I was in a hurry. And I had my AV set to update definitions later in the day. (The update that detected that virus was 2 hours late.)

Had any one of those things not been true I never would have run the masquerading spreadsheet and got infected.

Up until then I thought it would never happen to me. Now I hope it never happens again, but 100% vigilance just isn’t possible.

]]> By: automaton_be http://boingboing.net/2010/05/05/how-i-got-phished.html#comment-779687 automaton_be Wed, 30 Nov -0001 00:00:00 +0000 #comment-779687 A very nice perspective. We 'in the know' often look down on those simple souls who fall for scams like this. Yet, we are all one distraction away from becoming a 'simple soul'. On a vaguely related note, this is also the reason why usability and accessibility are not just important for handicapped people. We're all functionally impaired at some point or other. A very nice perspective. We ‘in the know’ often look down on those simple souls who fall for scams like this.
Yet, we are all one distraction away from becoming a ‘simple soul’.
On a vaguely related note, this is also the reason why usability and accessibility are not just important for handicapped people. We’re all functionally impaired at some point or other.

]]> By: numcrun http://boingboing.net/2010/05/05/how-i-got-phished.html#comment-779708 numcrun Wed, 30 Nov -0001 00:00:00 +0000 #comment-779708 Wow if you can be phished I guess pretty much anyone can. Both my hotmail and yahoo email accounts have been hijacked in the last 6 months. No-one else knows the passwords, and both computers I use are clean of viruses and spyware etc. I can only assume that the weak passwords cracked. Also I was phished by clicking a false ebay link, and was shocked at myself that I fell for it. Wow if you can be phished I guess pretty much anyone can. Both my hotmail and yahoo email accounts have been hijacked in the last 6 months. No-one else knows the passwords, and both computers I use are clean of viruses and spyware etc. I can only assume that the weak passwords cracked. Also I was phished by clicking a false ebay link, and was shocked at myself that I fell for it.

]]> By: Irene Delse http://boingboing.net/2010/05/05/how-i-got-phished.html#comment-780222 Irene Delse Wed, 30 Nov -0001 00:00:00 +0000 #comment-780222 <i>"Here’s the thing: I thought that phishers set their sights on a certain kind of naive person, someone who hadn’t heard all the warnings, hadn’t learned to be wary of their attacks."</i> Which brings irresistibly to mind the wisdom of con-man extraordinaire Moist von Lipvig, in Terry Pratchett's <i>Going Postal</i>: the best way to hoodwink a smart man is to let him believe he has <i>you</i> figured. “Here’s the thing: I thought that phishers set their sights on a certain kind of naive person, someone who hadn’t heard all the warnings, hadn’t learned to be wary of their attacks.”

Which brings irresistibly to mind the wisdom of con-man extraordinaire Moist von Lipvig, in Terry Pratchett’s Going Postal: the best way to hoodwink a smart man is to let him believe he has you figured.

]]> By: WalterBillington http://boingboing.net/2010/05/05/how-i-got-phished.html#comment-779727 WalterBillington Wed, 30 Nov -0001 00:00:00 +0000 #comment-779727 Umm ... caught out by a classic! Umm … caught out by a classic!

]]> By: Anonymous http://boingboing.net/2010/05/05/how-i-got-phished.html#comment-779731 Anonymous Wed, 30 Nov -0001 00:00:00 +0000 #comment-779731 Great column! I strongly believe that tiered defence is a part of the answer. We are used to the user/root level on our computers. We need to extend that model to access on twitter, gmail and so on. 99% of my gmail use (answering/sending one or a few emails at a time) could be done with limited access rights. Changing filters, mass forwarding/exporting, mass emailing, changing password and so on would need root. I'd gladly pay for that as a premium service. Great column! I strongly believe that tiered defence is a part of the answer. We are used to the user/root level on our computers. We need to extend that model to access on twitter, gmail and so on. 99% of my gmail use (answering/sending one or a few emails at a time) could be done with limited access rights. Changing filters, mass forwarding/exporting, mass emailing, changing password and so on would need root. I’d gladly pay for that as a premium service.

]]> By: Mister Ian http://boingboing.net/2010/05/05/how-i-got-phished.html#comment-780513 Mister Ian Wed, 30 Nov -0001 00:00:00 +0000 #comment-780513 A similaer thing happened to me on Twitter. I logged into Twitter properly immediately and changed my password. It was a shock to be suckered so easily! A similaer thing happened to me on Twitter. I logged into Twitter properly immediately and changed my password. It was a shock to be suckered so easily!

]]> By: Anonymous http://boingboing.net/2010/05/05/how-i-got-phished.html#comment-780525 Anonymous Wed, 30 Nov -0001 00:00:00 +0000 #comment-780525 “All complex ecosystems have parasites.” Socialists take note. “All complex ecosystems have parasites.”

Socialists take note.

]]>