 |
|
|
|
|
|
| |
| |
|
|
|
|
| |
| |
|
|
http://people.seas.harvard.edu/~rachna/papers/why_phishing_works.pdf
After reading this, I'm left wondering not so much "why does phishing
work?" but more "how can we ever hope to prevent it from working?"
--
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
Orchid XP v8 <voi### [at] dev null> wrote:
> After reading this, I'm left wondering not so much "why does phishing
> work?" but more "how can we ever hope to prevent it from working?"
One big problem is that people are so gullible. Even people who *should*
know better are surprisingly gullible.
For example, if you ask almost anyone why they don't buy viagra from an
email spammer, the typical answers will be along the lines of "I don't need
that stuff", "I don't want to give my money to dubious people", etc.
However, how many will list the following reason: "How do I even know it's
real viagra and not just a placebo, or worse, something harmful?"
I have the impression that surprisingly few people actually stop to think
that what they are selling might actually not be the genuine product. That's
why the spamming works: People who *want* the stuff and have no moral
problems about buying it from unofficial sources, never stop to think that
there's absolutely no guarantee that it really is the real stuff. After all,
those spammers are not controlled by any official entity who sees that they
are not fraudulent. However, most people just assume that they are selling
the real stuff.
People have forgotten the old rule "don't take candy from strangers",
and go one step ahead: They actually go and *buy* the candy from strangers,
without ever stopping to think what *is* in that candy.
--
- Warp
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
Warp wrote:
> Orchid XP v8 <voi### [at] devnull> wrote:
>> After reading this, I'm left wondering not so much "why does phishing
>> work?" but more "how can we ever hope to prevent it from working?"
>
> One big problem is that people are so gullible. Even people who *should*
> know better are surprisingly gullible.
>
> For example, if you ask almost anyone why they don't buy viagra from an
> email spammer, the typical answers will be along the lines of "I don't need
> that stuff", "I don't want to give my money to dubious people", etc.
>
> However, how many will list the following reason: "How do I even know it's
> real viagra and not just a placebo, or worse, something harmful?"
Or even that, I don't know, maybe they hand over their money and
*nothing* arrives? I mean, what are you going to do? Sue them??
This is why I don't buy things from ebay. As I understand it, you give
the seller your money, and they send you the item. Except that, AFAIK,
there is *no guarantee* that anything will ever actually arrive. (I
don't know whether ebay will refund your money in this instance... I'd
imagine not.) Of course, most ebay sellers are probably perfectly
geniune, but how do you tell?
> I have the impression that surprisingly few people actually stop to think
> that what they are selling might actually not be the genuine product.
Well, the online world isn't like the real world. I mean, you'd be
pretty hard-pressed to open up a highstreet shop that looks *exactly*
like John Lewis, take everybody's money, and then suddenly vanish. It
would be so absurdly expensive to set something like that up, you'd have
to harvest *a lot* of money to make it worth it. Oh, and good luck
evading detection!
Now, how hard would it be to copy the John Lewis website? Er...
actually, pretty trivial. Hire a cheap web host, copy a few files, set
up a CGI script to harvest credentials and put them somewhere. Assuming
you can trick a few people to visit it, you empty their accounts, and
head off to the Camen Islands before the cops even notice. Good luck
getting caught!
The study pointed out a few things:
1. Some people don't realise that websites can be copied. (And why would
you? It would be almost impossible to copy a real shop, or something
like a radio station.)
If you don't realise that it's possible to fake something, why would you
check it?
2. Some people think that it's "difficult" to copy web sites. (E.g.,
that it can never look *exactly* like the real thing.)
Of course, you and I know that computers are very good at copying files,
so it's actually a piece of cake.
3. People have short attention spans. (When was the last time *you*
checked the bank note you were given was actually genuine? You know
people do sometimes fake those, right?)
4. People have no idea what to actually look for. (In fairness, it does
take some knowledge to know what you're actually looking for. Especially
since, by the wonders of HTTP, the page you're looking at might be
unencrypted while the login data you send back *is* encrypted. I always
loved that feature!)
5. One of the sites uses XUL to alter the appearance of the web browser.
I mean, come *on*! Why does Firefox allow *that* FFS?! Even I wouldn't
be able to figure that one out... It's just downright dangerous.
--
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
Warp wrote:
> One big problem is that people are so gullible. Even people who *should*
> know better are surprisingly gullible.
Weee... now I'm wondering, how many computer experts would be fooled? ;-)
--
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
Orchid XP v8 <voi### [at] devnull> wrote:
> This is why I don't buy things from ebay. As I understand it, you give
> the seller your money, and they send you the item. Except that, AFAIK,
> there is *no guarantee* that anything will ever actually arrive. (I
> don't know whether ebay will refund your money in this instance... I'd
> imagine not.) Of course, most ebay sellers are probably perfectly
> geniune, but how do you tell?
If I'm not mistaken, ebay offers a service which acts as a third-party:
The seller sends the product to this service, and the buyer sends the
money. When both things have been sent, the service proceeds with the
transaction. If either the product or the money never arrives, the other
good gets returned.
Of course this service is not free.
--
- Warp
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
Warp wrote:
> When both things have been sent, the service proceeds with the
The word in English is "escrow", just so ya know.
Wouldn't paying with a credit card do the trick, at least in the USA?
Maybe that's why sellers prefer pay-pal? In the USA, if you buy
something on the credit card and it's unacceptable, you just tell the
bank "I'm not paying for this" and they take the money back from the
merchant.
--
Darren New / San Diego, CA, USA (PST)
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
Darren New wrote:
> The word in English is "escrow", just so ya know.
So *that's* what that word actually means...
> Wouldn't paying with a credit card do the trick, at least in the USA?
> Maybe that's why sellers prefer pay-pal? In the USA, if you buy
> something on the credit card and it's unacceptable, you just tell the
> bank "I'm not paying for this" and they take the money back from the
> merchant.
Ooo... I hear that banks are *really good* at gettings their own money
back. :-D
--
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
Orchid XP v8 wrote:
> Ooo... I hear that banks are *really good* at gettings their own money
> back. :-D
It depends, really. If the merchant can prove he did indeed ship it to
you (with fed ex receipts, say), then the bank eats the cost. This is
one of the reason rates are higher for taking credit cards for
mail-order than for walk-in stores.
--
Darren New / San Diego, CA, USA (PST)
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
>> Ooo... I hear that banks are *really good* at gettings their own money
>> back. :-D
>
> It depends, really. If the merchant can prove he did indeed ship it to
> you (with fed ex receipts, say), then the bank eats the cost. This is
> one of the reason rates are higher for taking credit cards for
> mail-order than for walk-in stores.
Well, maybe.
All I know is, if you owe the bank money, they usually make *damned*
sure they ****ing get it back! >:-)
--
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
Orchid XP v8 wrote:
> All I know is, if you owe the bank money, they usually make *damned*
> sure they ****ing get it back! >:-)
The US is a bit different. Particularly with credit cards.
--
Darren New / San Diego, CA, USA (PST)
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
Darren New wrote:
> The US is a bit different.
Damn straight!
> Particularly with credit cards.
...oh, right. Yeah, that too. ;-)
--
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
> -----Original Message-----
> From: Darren New [mailto:dne### [at] sanrrcom]
> Wouldn't paying with a credit card do the trick, at least in the USA?
> Maybe that's why sellers prefer pay-pal?
Absolutely. Paypal themselves, in addition to the protection you get
from credit cards, tracks sellers' reputations, and will refuse to do
business if you've been found to cheat people.
Additionally, banks are quite aggressive in pursuing fraudsters. About
once a month I have to talk with our main fraud investigator about
something, and let me tell you... she is one of the most intimidating
people I have ever met in my life. I would NOT want to be a target in
her sights.
...Ben Chambers
www.pacificwebguy.com
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
On Sun, 16 Nov 2008 11:33:51 +0000, Orchid XP v8 wrote:
> Or even that, I don't know, maybe they hand over their money and
> *nothing* arrives? I mean, what are you going to do? Sue them??
>
> This is why I don't buy things from ebay. As I understand it, you give
> the seller your money, and they send you the item. Except that, AFAIK,
> there is *no guarantee* that anything will ever actually arrive. (I
> don't know whether ebay will refund your money in this instance... I'd
> imagine not.) Of course, most ebay sellers are probably perfectly
> geniune, but how do you tell?
This is what seller reputations are for.
Jim
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
Jim Henderson wrote:
> This is what seller reputations are for.
Unfortunately, that only works when people don't interfere with it. If
you get sued for giving a bad rating, or the site itself disallows you
from giving a bad rating, they work much less well.
--
Darren New / San Diego, CA, USA (PST)
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
On Mon, 17 Nov 2008 13:38:54 -0800, Darren New wrote:
> Jim Henderson wrote:
>> This is what seller reputations are for.
>
> Unfortunately, that only works when people don't interfere with it. If
> you get sued for giving a bad rating, or the site itself disallows you
> from giving a bad rating, they work much less well.
True....but it's a good starting point.
Jim
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
>> Unfortunately, that only works when people don't interfere with it. If
>> you get sued for giving a bad rating, or the site itself disallows you
>> from giving a bad rating, they work much less well.
>
> True....but it's a good starting point.
Also pay with your credit card (via PayPal) and then if you always buy from
people with more than 50 feedback (or whatever the figure is) you are
entitled to a refund up to 500 GBP if you don't get the goods. That's how
it worked last time I looked, because I sent something worth around 250 GBP
and the parcel company "lost" it (I think even today the website still says
"out for delivery" from like November last year!).
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
On Tue, 18 Nov 2008 08:57:09 +0100, scott wrote:
>>> Unfortunately, that only works when people don't interfere with it. If
>>> you get sued for giving a bad rating, or the site itself disallows you
>>> from giving a bad rating, they work much less well.
>>
>> True....but it's a good starting point.
>
> Also pay with your credit card (via PayPal) and then if you always buy
> from people with more than 50 feedback (or whatever the figure is) you
> are entitled to a refund up to 500 GBP if you don't get the goods.
> That's how it worked last time I looked, because I sent something worth
> around 250 GBP and the parcel company "lost" it (I think even today the
> website still says "out for delivery" from like November last year!).
That's good to know, I didn't know that. (My wife does most of the
buying on eBay. :-) )
Jim
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
|
|
