Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Launch HN: Riot (YC W20) – Phishing training for your team

news.ycombinator.com

Post reply on HN
Print view View original

61–70 of 93 posts

Re: Launch HN: Riot (YC W20) – Phishing training for your team

#61

Post by closeparen »

nothrabannosir wrote: post #54
jedberg wrote: post #11

> Would love to hear your war stories on phishing scams, and how you train your teams! I was working on anti-phishing in 2003, before it had the name phishing. We were trying to teach our users not to fall for the scams. It didn't work. People will fall for the same scam over and over. The conclusion we came to was that the only solution to phishing was education, and education was also nearly impossible to get 100%…

> The conclusion we came to was that the only solution to phishing was education, and education was also nearly impossible to get 100% coverage. A friend works for a company that fires employees after failing three phishing tests. It doesn’t solve the problem for those people, but it does work for that company. What has priority depends on your management style :)

The only way to pass the phishing tests at my employer is to never click links in email. But then we also have a number of official systems sending emails with links in them (bug tracking, code review, Zoom invites, HR portal, etc).

The only way this kind of policy makes sense is if you have to actually give the phishing site some kind of credential in order to fail, vs. merely opening on it.

If someone has a Chrome zero-day, we're done anyway. Just post it on HN.

Re: Launch HN: Riot (YC W20) – Phishing training for your team

#62

Post by skocznymroczny »

At the company I work at they send phishing training emails every now and then. Luckily, the email headers have special fields, so that the IT firewall lets the "spam" through. I managed to set up a rule in my outlook to catch these headers and move all the emails to a special "Phish" folder.

Re: Launch HN: Riot (YC W20) – Phishing training for your team

#63

Post by dmurray »

rsync wrote: post #48

I wonder if you can comment on the weirdly pro-phishing behavior of many US banks who, if I didn't know better, appear to be trying hard to make their customers vulnerable to phishing attacks ... - TIAA Bank redirects customers, after login, to "cibng.ibanking-services.com". - US Bank, depending on which account you log into will redirect you to "loansphereservicingdigital.bkiconnect.com". - Union Bank will redirect…

My bank in Ireland (Ulster Bank) has a notice on the login page: "You will NEVER need your card reader [their 2FA] to log in". Last year they changed their login flow so you are asked to use your card reader to log in. I complained about it on Twitter but got a meaningless response about customer safety/new regulations.

If they wanted to train their customers to be phished, I can't think how they could do a better job.

Re: Launch HN: Riot (YC W20) – Phishing training for your team

#64

Post by _xnmw »

Everyone's vulnerable to phishing, no matter how technically literate. It's too easy to click through an email during a moment of inattention. I've often thought that the only way to reliably prevent phishing is to enforce the use of a password manager browser extension, which will refuse to enter a saved password except on the original domain. Nobody should ever be manually typing passwords, or even copy-pasting passwords (in the rare case copying becomes necessary, it should be done with a big bold warning).

A safer, phish-proof enterprise password manager may be your killer product here.

Re: Launch HN: Riot (YC W20) – Phishing training for your team

#65

Post by johnwheeler »

brobinson wrote: post #45
johnwheeler wrote: post #35

Earlier quoted context omitted.

Did you try punitive disincentives?

A better approach is to turn it into a game: reward those who report suspected phishing emails, security breaches, tailgating into secure areas, USB devices left around, etc. and have red teams doing this stuff periodically. Punitive measures don't really work. Friendly competition with rewards does work, though.

that's a good point :D

Re: Launch HN: Riot (YC W20) – Phishing training for your team

#66

Post by jujodi »

_xnmw wrote: post #64

Everyone's vulnerable to phishing, no matter how technically literate. It's too easy to click through an email during a moment of inattention. I've often thought that the only way to reliably prevent phishing is to enforce the use of a password manager browser extension, which will refuse to enter a saved password except on the original domain. Nobody should ever be manually typing passwords, or even copy-pasting pas…

For some reason I thought this was the pitch and I LOVE this idea. Is it possible for a password manager plugin to capture your "paste" and verify the window url? I know there's an onpaste clipboard event so sure seems like this would be possible.

Re: Launch HN: Riot (YC W20) – Phishing training for your team

#67

Post by jujodi »

BenjaminN wrote: post #13
eggbrain wrote: post #10

How do you work with the service providers you use to host your platform and send out emails (e.g. Heroku / Mailgun) to let them know you are not a malicious phishing company, but an anti-phishing company? I say this because I ended up reporting the phishing email I received from you guys to Mailgun, and I believe accidentally got your account disabled. Sorry about that.

YES you did! I called them just right after that, and I have to say they've been great so far. We agreed I would pay for a dedicated IP, and they now fully support Riot. And having a dedicated IP is actually better, because you can now remove the unexpected warning on Gmail.

This is amazing. As long as none of your "unsuspecting" "victims" notice you have a dedicated IP lol

Re: Launch HN: Riot (YC W20) – Phishing training for your team

#68

Post by jujodi »

The only time that a phishing attempt actually worked for our company (afaik) occurred when someone emailed an executive in our company (ugh) with a docusign looking email with content that he was EXPECTING. it redirected him to a fake Active Directory sign in link that he fell for. Immediately after entering his password his outlook spammed his entire contact list with the same phish except addressed to them specifically from his actual email, with a link that looked like a shared Office 365 document. It wasn't good.

Re: Launch HN: Riot (YC W20) – Phishing training for your team

#69

Post by jedberg »

nothrabannosir wrote: post #54
jedberg wrote: post #11

> Would love to hear your war stories on phishing scams, and how you train your teams! I was working on anti-phishing in 2003, before it had the name phishing. We were trying to teach our users not to fall for the scams. It didn't work. People will fall for the same scam over and over. The conclusion we came to was that the only solution to phishing was education, and education was also nearly impossible to get 100%…

> The conclusion we came to was that the only solution to phishing was education, and education was also nearly impossible to get 100% coverage. A friend works for a company that fires employees after failing three phishing tests. It doesn’t solve the problem for those people, but it does work for that company. What has priority depends on your management style :)

Then I would have gotten fired. That's a ridiculous policy. Do they fire people for making mistakes too?

As a security engineer in a previous life, I always open the links in phishing emails (in an isolated and secure VM). I would fail the tests at work every time, but luckily the person in charge of them knew what I was doing and didn't care.

Re: Launch HN: Riot (YC W20) – Phishing training for your team

#70

Post by jedberg »

johnwheeler wrote: post #35
jedberg wrote: post #24

Earlier quoted context omitted.

Definitely worth trying! Just want to help you set expectations. :)

Did you try punitive disincentives?

In our case we were educating and protecting our customers. It's usually bad policy to carry out punitive punishment on your customers. :)

In fact, the worst offenders were actually rewarded. They were the only ones who had two factor auth for their eBay accounts. Back then we didn't have soft tokens -- the only way to do 2 factor was to get a physical RSA token, which cost about $10 at the time. So only the "best" customers were worth the cost.

Post reply on HN