Gitlab phished its own work-from-home staff, and 1 in 5 fell for it

Re:Gitlab phished its own work-from-home staff, and 1 in 5 f... by jfkebwjsbx on Saturday May 23, 2020 @08:14AM (#23282287)

> The email client is specifically designed to be able to display untrusted mail.

No, they weren’t, which means chances are you are using one that wasn’t.

> web browsers are designed to be able to load untrusted content from the internet safely

Yes, but they aren’t perfect.

[ Parent | on HN ]

Re:Gitlab phished its own work-from-home staff, and 1 in 5 f... by technion on Saturday May 23, 2020 @08:24AM (#23282354)

You cannot reasonably expect a person to refuse to even look at a suspicious email. Let's say your support product x at your workplace. From: Person you don't know. Subject: Bug report.

Noone would delete that email without reading it, just like the finance department when they see something claiming to be a bill. Now what if your email said "I have sample website that demonstrates this bug". Again, there's no reason for you to not click that. The only thing that you should be able to reasonably expect a person to "fail" on is getting there and downloading a .exe or providing a set of credentials.

[ Parent | on HN ]

Re:Gitlab phished its own work-from-home staff, and 1 in 5 f... by jfkebwjsbx on Saturday May 23, 2020 @02:31PM (#23285237)

I have not claimed otherwise.

Please read my message again.

[ Parent | on HN ]