I always have a wry smile on my face when I read the lazy assumption that a large proportion of the workforce is not made up of large numbers of “someone’s mother” or “someone’s grandmother”, let alone the fact that for some reason it always has to be a woman in these contexts.

Our fathers can't even turn the blasted things on.

> But also, PGP web of trust would break in larger adoption.

Agree with you. My guess is very quickly people would start to ultimately trust all they friends and colleagues. There would be phishing bots to convince you to trust other bots and fake profiles, etc.

In cases like this it doesn't matter so much, this attack wouldn't even work over LinkedIn's web of trust.

Why wouldn't it? If you ultimately trusted a colleague that was phished into trusting the attacker, then you would trust the attacker to be who he claims to be.

They would need less believable stories and to impersonate interns, subcontractors, etc.

The pattern in the attacks could be extremely brazen, like impersonation of the editor themself or a higher position colleague to resist social checks.

Pretty strange for a long term editor to have few paths to themselves within their own publisher. (Since each attempt to gain a new connection in the publisher risks someone noticing the email address is a fraud of their own company and cause revocations.)

If the attack is 100 or 1000 times less effective it is probably written off as a complete waste of resources.

Professional context would be demanding PDF, HTML or Word Docs over plain text, relying on a Virus Scanner. Everything on MS Windows. That's easy enough for the average phishing campaign.

Enigmail or average joe PGP integration does help, but your phisher won't use PGP. What helps is proper cooperate culture. No html, no pdf, no office docs over email. Best, no email at all.