Live data from Hacker News

Ask HN: Protect loved ones from online scams?

news.ycombinator.com

31–40 of 62 posts

Re: Ask HN: Protect loved ones from online scams?

#31
When it comes to protecting login passwords from phishing emails, it is said that U2F hardware tokens are the best (yubikey etc) but it might not be the easiest solution for non-techies.

Good advice is to never click links in emails, but go manually to a given page (via Google perhaps) and log in yourself.

It's a bit easier if your family lives outside of English-speaking country when it comes to phishing. Phishing spam is either English, or a poor google translate 95% of the time.

Re: Ask HN: Protect loved ones from online scams?

#32
post #3

What really irks me is getting an email like this: Shipping account suspended Dear XXXX, FedEx shipping privileges for account number ending in NNNN have been suspended. To access and update your credit card data, log in to FedEx® Billing Online. Log in today (Button) This just screams "scam", especially since I haven't used the FedEx account in months. When I log into FedEx (not using the link in the email), my acco…

I wonder if the link is to something on FedEx's site that has an XSS vuln and redirects elsewhere?

Re: Ask HN: Protect loved ones from online scams?

#33
post #5

The internet just isn't safe for some users right now. Encourage them to call you if they're doubtful, never click Ads and to never interact with people that initiate contact with them first.

Its not just ads.

SEO affects search engines like Google, putting shady businesses high in the search result (sometimes even #1).

I've seen this first hand with my mother who needed a locksmith because the lock on her front door broke. The cost of 'repairing' was well over 500 EUR, and the lock wasn't repaired at all, it had to be completely replaced afterwards by a real locksmith which was legit but due to the damage the scammer caused was expensive a well. This is a known scam trick going on in The Netherlands, but probably just one of the many examples.

Re: Ask HN: Protect loved ones from online scams?

#34
post #3

What really irks me is getting an email like this: Shipping account suspended Dear XXXX, FedEx shipping privileges for account number ending in NNNN have been suspended. To access and update your credit card data, log in to FedEx® Billing Online. Log in today (Button) This just screams "scam", especially since I haven't used the FedEx account in months. When I log into FedEx (not using the link in the email), my acco…

I've made the same complaint, "you're training people to click on links," to I-forget-who. "Your security is important to us, and we'll send that directly to the crickets."

Either the people you are able to contact don't care, because they have no idea what you're talking about, or they don't care because they wrote/required exactly what you're complaining about, out of expediency or ignorance.

Re: Ask HN: Protect loved ones from online scams?

#35
post #7

Earlier quoted context omitted.

It is very easy to spoof an email address[1], so it could be that it is someone from outside of FedEx. https://superuser.com/questions/505503/how-can-you-fake-an-e...

However you can still check the IP address of the mail server that sent the mail. Some things to look at: 1. Check PTR for IP and verify that the A or AAAA record for that name points back to the same IP. 2. Compare with IP address of server that sent previous mail to you. 3. Check SPF records for the domain. 4. Check MX records for the domain. Keep in mind that they might be using different servers for sending than…

These sound like good steps to determine if a sender is legitimate. Is there a plugin that already does this for existing email clients?

Re: Ask HN: Protect loved ones from online scams?

#36
post #16

Gift your loved ones an iPad or Android tablet, maybe also enable some parent control to limit their exposure. 90% of end users don't need a notebook, a tablet is the safer alternative.

Not Android. The lack of updates and ease of installing a third party APK is just too high (not mentioning the occasional malware in the Play Store itself).

Re: Ask HN: Protect loved ones from online scams?

#37

Earlier quoted context omitted.

However you can still check the IP address of the mail server that sent the mail. Some things to look at: 1. Check PTR for IP and verify that the A or AAAA record for that name points back to the same IP. 2. Compare with IP address of server that sent previous mail to you. 3. Check SPF records for the domain. 4. Check MX records for the domain. Keep in mind that they might be using different servers for sending than…

These sound like good steps to determine if a sender is legitimate. Is there a plugin that already does this for existing email clients?

[deleted]

Re: Ask HN: Protect loved ones from online scams?

#38
post #9
post #7

Earlier quoted context omitted.

It is very easy to spoof an email address[1], so it could be that it is someone from outside of FedEx. https://superuser.com/questions/505503/how-can-you-fake-an-e...

With SPF, DKIM, DMARC, coupled with blacklists and the reputation system of big mail providers that's making it difficult to host your own email, it's actually quite to impersonate an email address. Try it, then see how many times you can hit a @gmail address.

I found that this does not stop one from sending emails that appear to originate from addresses like info@paypal.com as long as the contents of the email are different from known spam emails. They are not flagged by GMail at all as long as you send them from a reputable email server through services like mailgun.com.

Re: Ask HN: Protect loved ones from online scams?

#39
I bought my mom an iPad (the largest one at the time) and bought her a printer that works with her iPad. In the two years since that, the only call that I've ever received was "Does this pop up that says 'OK/Cancel' that says my iPad is infected with a virus actually mean anything?" "No, Mom." "Ahh, ok. I didn't think so."

Works like a charm.

Re: Ask HN: Protect loved ones from online scams?

#40
post #3

What really irks me is getting an email like this: Shipping account suspended Dear XXXX, FedEx shipping privileges for account number ending in NNNN have been suspended. To access and update your credit card data, log in to FedEx® Billing Online. Log in today (Button) This just screams "scam", especially since I haven't used the FedEx account in months. When I log into FedEx (not using the link in the email), my acco…

Tweet their customer service (@FedExHelp). My friend who works in tech support (not at FedEx) recommends this practice.
Post reply on HN