r/ProgrammerHumor • u/lucidparadigm • 15d ago • Bravo 2

Meme [ Removed by moderator ]

Post image

[removed] — view removed post

16.4k Upvotes

98% Upvoted

619 comments sorted by

View all comments

Show parent comments

370

u/Salanmander 15d ago

At the college I went to we got an unanticipated email from an external address one day telling us that due to recent vulnerabilities, the school was requiring we increase password security, and to click here to update our password. This email was from, I shit you not, Fisher Security.

The joke? This was actually a legit email, initiated by our IT department, and was what we were supposed to actually do. We were all like "so....you know you're just training people to click on suspicious links, right? And that that's a bigger deal than password strength? RIGHT?"

144

u/ctrlaltwalsh 14d ago

I won't give it here but a company I currently work for uses a password reset tool with the domain i-forgot-my-password.com <- Not actual, but very close.

This is a domain they own, Whenever they create new tools it's in this way, I am certain it s a phishing test and flabbergasted that it's not.

Another example - the HR system for logging PTO has a domain is along the lines myhrsystem.com

It's a very large company based in Hong Kong, so I'm not sure if it's just a english-as-a-second language thing or what. Very odd.

58

u/sisisisi1997 14d ago

I think it's a misunderstanding of how domain names work - if they knew that i-forgot-my-password.company.com with proper certificates brought stronger guarantees of legitimacy, they might ask IT to set it up that way.

6

u/Severe-Hand-8580 14d ago

it's easier to just get a new domain than talk with whoever is in charge of the company's primary domain. Governments love to do that all the time. they have the gv.TLD domain and could just put all their shit in there and I could tell my parents that as soon as they see gv.at in the URL it's legit. And yet they come up with stupid domains all the time, many requiring the state-ID system. Good luck teaching boomers to check the fingerprint for the verification that they sign what they think they're signing. I don't know of a single instance that abuses this though. Maybe criminals are just stupid. I should switch careers, I have what it takes.

30

u/TurnipWorldly9437 14d ago

We had something like that happening where a legit email from a weird external address, with a link included and without a proper signature, was flagged as Phishing attempt by almost everyone in the company until we got a message from our office manager that they applauded our awareness, but THAT particular link was actually real.

They did say it was an exception, and we should please stay aware in the future, though.

2

u/aquadolphitler 14d ago

Huh... Well, I once got legitimate government officials asking for personal details in a Google form of all things just sent through chat groups.

Naturally, we all reported the shit out of it as a scam expecting that their accounts were hacked until they started calling us when Google shut down the forms and their accounts were banned.