Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The scariest "user support" email I've received

devas.life

Post reply on HN
Print view View original

251–260 of 267 posts

Re: The scariest "user support" email I've received

#251

Post by hinkley »

gblargg wrote: post #145
hinkley wrote: post #52

To me the scariest support email would be discovering that the customer's 'bug' is actually evidence that they are in mortal danger, and not being sure the assailant wasn't reading everything I'm telling the customer. I thought perhaps this was going that way up until around the echo | bash bit. I don't think this one is particularly scary. I've brushed much closer to Death even without spear-phishing being involved.

Several 911 calls of people sounding to be ordering a pizza but calling for help, where they attacker can also hear the caller. Example: https://youtu.be/UiWTmUNDFRg

Just last night YouTube suggested that YouTube clip of the woman whose lawyer in a restraining order/domestic violence case teleconference told the judge she was afraid her client’s husband was in the house with her and the judge made him take his computer outside where police were waiting to arrest him.

Personally I think the judge should have made the woman go outside first, but “inside a suspect’s house” is statistically more dangerous than a traffic stop, which is the second most dangerous place for a cop to be.

I was more thinking of soon-to-be political prisoners but there are a lot of situations that match what I said.

Re: The scariest "user support" email I've received

#252

Post by dangus »

account42 wrote: post #222
dangus wrote: post #101

This is tame and not scary compared to the kinds of real live human social engineering scams I’ve seen especially targeting senior leaders. With those scams there’s a budget for real human scammers. This thing was a very obvious scam almost immediately. What real customer provides a screenshot with Google sites, captcha, and then asking you to run a terminal program? Most non-technical users wouldn’t even fall for th…

Even the most obvious scams will have reasonably educated people falling for them when they are tired or distracted enough.

Not from a cold email to a support line. Remember that this isn’t a personal email where people can be contacting you for all kinds of reasons.

The amount of legitimate reasons to ever open a link in a support email is basically zero.

When you have a company policy enforced by training and/or technology there is no thought involved, you just respond with “sorry, we can’t open external links. Please attach your screenshot to [ticketing system].”

Your ticketing/email system can literally remove all links automatically right?

Re: The scariest "user support" email I've received

#253

Post by bofadeez »

account42 wrote: post #212
bofadeez wrote: post #175

Earlier quoted context omitted.

Yeah it's interesting. What's the incentive to spend 10 years learning tedious stuff anymore? In another 1-2 generations all non AI knowledge will be gone.

The incentive is the desire to improve yourself. What the world around you does shouldn't affect that incentive.

Okay, so one can "improve themselves" as a hobby at a leisurely pace instead of cramming for exams and becoming a competitive professional. Same thing.

"Show me the incentive and I'll show you the outcome"

Re: The scariest "user support" email I've received

#254

Post by lukeschlather »

croes wrote: post #159
lukeschlather wrote: post #140

Earlier quoted context omitted.

I'm copy-pasting something that is intended to be copy-pasted into a terminal and run. The first tool I'm going to reach for to base64 decode something is a terminal, which is obviously the last place I should copy-paste this string. Nothing wrong with pasting it into ChatGPT. When I come across obviously malicious payloads I get a little paranoid. I don't know why copy-pasting it somewhere might cause a problem, but…

So you are less confident pasting it in https://www.base64decode.org/ than in https://chatgpt.com ? That makes no sense.

I pay ChatGPT money and I have more confidence they've thought about XSS and what might happen with malicious payloads. I guess ChatGPT is less deterministic. Maybe you're right and I'm not paranoid enough, but I would prefer to use an offline tool (and using an LLM does seem worthwhile since it can do more, I can guess it's base64, the LLM can probably tell me if it's something more exotic, or if there's something within the base64 that's interesting. I can do that by hand but the LLM is probably going to tell me more about it faster than I can do it by hand. So it's worth the risk, while pasting it into base64decode.org doesn't seem worth the risk vs. something offline.)

If you think that there's obvious answers to what is and isn't safe here I think you're not paranoid enough. Everything carries risk and some of it depends on what I know; some tools might be more or less useful depending on what I know how to do with them, so your set of tools that are worth the risk are going to be different from mine.

Re: The scariest "user support" email I've received

#255

Post by sunaookami »

frenchtoast8 wrote: post #19

I'm seeing a lot more of these phishing links relying on sites.google.com . Users are becoming trained to look at the domain, which appears correct to them. Is it a mistake of Google to continue to let people post user content on a subdomain of their main domain?

When you share a link through the Google app it now gets "helpfully" shortened to a "share.google" domain. This is even worse.

Re: The scariest "user support" email I've received

#256

Post by Dilettante_ »

juped wrote: post #137

I hope everyone who posts a variation of "someone really fell for phishing? how stupid, I would never fall for phishing" falls for phishing soon.

That sounds like you or someone close to you has been a victim of phishing before. Care to share the experience?

Re: The scariest "user support" email I've received

#257

Post by justinclift »

radu_floricica wrote: post #243
justinclift wrote: post #206

Earlier quoted context omitted.

> ChatGPT is _satisficing_, not optimal. But is it _always_ accurate? The answer to that is important when there are security implications.

The security implication here was writing a blog post. You're allowed to use a cheap box cutter even if you work at NASA, as long as you use it to open mail. That's what satisficing means.

> The security implication here was writing a blog post.

Not sure why you're only looking at that part of it?

Re: The scariest "user support" email I've received

#258

Post by Arainach »

croes wrote: post #163
Arainach wrote: post #97

Earlier quoted context omitted.

Correct, but again this is one of the things LLMs are consistently good at and an actual time saver. I'm very much an AI skeptic, but it's undeniable that LLMs have obsoleted 30 years worth of bash scripting knowledge - any time I think "I could take 5min and write that" an LLM can do it in under 30 seconds and adds a lot more input validation checks than I would in 5min. It also gets the regex right the first time,…

https://www.base64decode.org/ is faster than ChatGPT to decode the base64. And I truly hope nobody needs ChatGPT to tell them that running an unknown curl command is a very bad idea. The problem is the waste of resources for such a simple task. No wonder we need so much more power plants.

Knowing that site exists, remembering that it does (and what it's called), going to a web browser, going to that site, and using it is faster than a tool that plenty of people have open constantly at this point?

Again, I am an AI skeptic and hate the power usage, but it's obvious why people turn to it in this scenario.

Re: The scariest "user support" email I've received

#259

Post by p3rls »

Apocryphon wrote: post #88
duskwuff wrote: post #70

Earlier quoted context omitted.

> the personal website that would be casually hosted whenever your PC is on I don't think that was ever really a thing. Which isn't to say that no one did it, but it was never a common practice. And free web site hosting came earlier than you're implying - sites like Tripod and Angelfire launched in the mid-1990s, at a time when most users were still on dialup.

earliest of the three, GeoCities launched in 1994

[dead]

Re: The scariest "user support" email I've received

#260

Post by 1718627440 »

miki123211 wrote: post #190
mort96 wrote: post #177

Earlier quoted context omitted.

Nah this is more like, "Why do you consult the vibes oracle to compute 7 * 5? Just use a calculator!" .. which is, to be honest, a criticism I would make if I saw someone try to ask ChatGPT to do math .. and, FWIW, that is exactly what's happening here; base64 decode is just math

> if I saw someone try to ask ChatGPT to do math This makes me wonder how many kids are using Chat GPT as a calculator.

This is ridiculous, given that even the browser itself already includes a calculator in the URL-bar, and they are probably not using a website without a browser.
Post reply on HN