When in doubt: hang up, look up, and call back - <AUTHOR> https://krebsonsecurity.com/2020/04/when-in-doubt-hang-up-look-up-call-back/ <comment><USER4> This also applies to offline solicitation. Someone came to my door and asked me to sign on to switching my gas supplier. He said it is a supply chain change and will not affect anything beyond I getting a smaller monthly bill, still coming from PG&E. I told him that it sounds wonderful but this is the first I'm hearing of such a thing and I need to research online what it is about before signing anything. He said he has all the details in his paper folder and I can read it. I insisted on doing my own research. He said the deal is off once he leaves and it is my last chance. I told him, "so be it, such is life".

Did a quick Google search the next day and figured the process is legit but people out there have gotten higher bills than before.

Moral is to fight the human-interaction pressures and be adamant on doing your own research. No shame in that.

<comment><USER5> If someone knocks on my door and I haven't invited them over I don't even consider answering it. It doesn't matter to me what sort of uniform they are wearing. The same goes phone calls. I don't understand the obligation people feel to engage in unsolicited meetings and conversations.

<comment><USER6> I get what you're saying, but I get irate at people who don't answer calls from unknown numbers. Spam or soliciting? Hang up and block caller. It doesn't take more than 5 seconds.

I've been in situations when I don't have access to my cell phone and I need help from friends, so I call from a stranger's cellphone. I never get an answer. I have to text them from the stranger's phone (and see their text messages), wait for them to see the message, then accept the call. It's incredibly frustrating.

<comment><USER7> One problem here is that by answering at all, you're confirming your phone number as one with a real live person on the end. They track this and will keep calling. Anecdotally I noticed after I stopped picking up, the number of calls I was getting decreased.

<comment><USER8> I like to pick up and immediately hit mute. If they say something, maybe I reply, but typically the spam callers just hang up after a few seconds. I read somewhere that picking up but not saying anything can take you off the rotation or something

<comment><USER9> I've done the same for a span of a couple months--immediate mute, no interaction. It didn't seem to make a difference one way or other other though with regard to call frequency.

</comment></comment></comment></comment></comment></comment><comment><USER10> Not so long ago, I got a legitimate phone call from my bank's fraud department (HSBC HK) regarding a dispute I had made (someone had used my credit card to book on booking.com).

The bank employee asked me to give him my passport number and acted annoyed when I refused. He couldn't understand why I would not give this kind of private information on a phone call and why it was a breach of security. I then called the bank's customer service hotline and they had no record of the call from the fraud department being made because it's a separate department and they didn't have access to that data. It took 3 days before I got a confirmation from my bank that that call had indeed been legitimate (and that's only because I have a relationship manager)...

So I think Banks are part of the problem, they need to massively step up their training in security so as not to make this kind of demands on phone calls they have themselves initiated.

<comment><USER11> Funny you should say that, I've had several calls from my bank - HSBC UK - <USER2> have then asked me for information to 'prove my identity. When I've said "you phoned me, you could be anyone, I'm not doing that", they got pretty annoyed, and didn't see why I was saying that I wouldn't give away the information. I phoned them back and then it was OK - when I spoke to the same person (she'd given me an extension to give once I'd phoned the main, publicly verifiable number), she seemed surprised that I'd take such steps.

It's not just banks - I get the same spiel from my insurers, who say they have to check the information "for data protection" \- oblivious of the fact that them regularly doing this means that they're setting the scene for people inadvertently leaking the information they take as sacrosanct!

<comment><USER12> I'm with HSBC too and they seem to be a bit too cautious with their debit card fraud. I get my card blocked a couple times a year.

Whenever they've phoned me and I've told them I don't want to give out my info they just tell me to call the number on the back of my card. Never had anyone act annoyed towards me. Maybe it's because I never act annoyed or accusatory towards them, so they don't act the same towards me. I just tell them that I'd rather not give my info out to someone who's phoned me

</comment></comment></comment><comment><USER13> _> But he said he still feels like a chump for not observing the golden rule: If someone calls saying they're from your bank, just hang up and call them back — ideally using a phone number that came from the bank's Web site or from the back of your payment card. As it happened, Mitch only followed half of that advice._

Banks could normalize this behavior by having their customer service reps ask customers to do this at the beginning of every call.

"Hi, this is <csr> calling from <bank>. We'd like to talk to you about <subject>. To ensure to you that this is not a fraudulent call, please look up the phone number for this bank and call us back. Thank you."

<comment><USER14> _> "Hi, this is <csr> calling from <bank>. We'd like to talk to you about <subject>. To ensure to you that this is not a fraudulent call, please look up the phone number for this bank and call us back. Thank you."_

This would be great as long as your call back was recognized and immediately routed to the right person instead of being placed on infinite hold, as is usually the case when you call a bank's or credit card company's number.

<comment><USER15> >as long as your call back was recognized and immediately routed to the right person

It would be great if more companies had this functionality. It would also be useful in the situations where you get disconnected while talking with someone.

<comment><USER16> Most contact centers have some sort of virtual hold - i wonder if they can leverage that tech for this type of functionality.

<comment><USER17> Or use something really old school such as "extension numbers".

<comment><USER15> Basically, I'd prefer if pbxes used by these companies providing support did the equivalent of storing short-term 'cookies' that remember you had just called rather than requiring remembering and reentering 'share urls'.

</comment></comment></comment></comment></comment></comment><comment><USER18> I got an call on my Verizon phone. It showed up as Verizon on the caller ID. The guy said there was a problem with my payment but I was busy and said I'd call back later. When I called that number back later they didn't know what I was calling about. I said "you called me" and they said "oh that's a scam, we never call you. If we call don't pick up"

If Verizon can't stop people from spoofing their own customer support number on their own network, we're all screwed.

<comment><USER19> They (all phone providers) can stop the caller ID spoofing. They just don't want to invest the time and money to do so. It's finally a bipartisan issue but as long as Ajit Pai is the FCC chairman, nothing will happen aside from a few pay to block gambits.

<comment><USER20> "FCC requires carriers to deploy STIR/SHAKEN caller ID authentication" \- [https://www.fiercewireless.com/operators/fcc-requires- carrie...](https://www.fiercewireless.com/operators/fcc-requires-carriers-put- stir-shaken-caller-id-tech-place)

<comment><USER21> iirc the FCC moved from "recommending" STIR/SHAKEN to requiring it due to foot-dragging on the carrier's part

</comment></comment></comment></comment><comment><USER22> I just had this experience from pnc bank. I don't even bank with them, but a member of my household does.

The incoming message was automated, asking for (person who lives here) with a visa debit card that has fraudulent transactions. The caller id was a number not listed on the back of the card.

Pressing "1" puts you into the next phase, which asks you to "verify" your identity by - guess what - typing in your full 16 digit debit card number!

At this point I am convinced this is a scam. You google the phone number and you see tons of links saying it's a scam.

The person calls their regular number on the back of her card and they claim no fraudulent activity.

A few days later I still get these calls so I decide to investigate. Pressing zero a bunch and asking for an agent finally gets me to a live individual. He claims they're from pnc and they are a different section not connected to the "main" number. He's able to recite details about the account that only pnc would know, so now I'm not sure.

I email email@example.com asking them to please either say the calls are fraudulent or acknowledge that the phone number associated with these calls is legitimate (it doesn't appear anywhere on pnc's web site)

I did get a response - good! But they didn't actually change the site ... so I suppose in this case anyone who receives notification of fraud on their pnc debit card should email firstname.lastname@example.com to validate the calls are legitimate?

<comment><USER23> > I email email@example.com asking them to please either say the calls are > fraudulent or acknowledge that the phone number associated with these calls > is legitimate (it doesn't appear anywhere on pnc's web site)

Note that faking the number you are calling from is fairly trivial, so do not trust the callerid as proof of identity.

<comment><USER22> I should have clarified: I called the number back (from the caller ID)

</comment></comment></comment><comment><USER24> > _"When the representative finally answered my call, I asked them to confirm > that I was on the phone with them on the other line in the call they > initiated toward me, and so the rep somehow checked and saw that there was > another active call with Mitch," he said. "But as it turned out, that other > call was the attackers also talking to my bank pretending to be me."_

Jesus Christ. This is some Inception-level shit. I do not operate on this many levels of meta in real life.

<comment><USER25> It's not the first time I've heard of a scam like this. Scammers are increasingly sophisticated about this, basically performing a kind of man-in- the-middle attack on the phone between you and your bank. And phone protocols aren't secure enough to deal with this.

</comment></comment><comment><USER26> Krebs mentioned that Mitch logged into his bank account while on the phone with the scammers. That's a HUGE no. We live in a threshold period where acoustic emanation attacks are about to become much more commonplace due to increasing computational capabilities. [0]

Getting you to browse your computer for 10-20 minutes and then log into your bank account could be enough to gain access to your account.

And 2FA is proven insecure with SIM hijacking. These methods have a high up front time investment but will take even less effort than Mitch's gambit once deployed.

[https://www.cs.cornell.edu/~shmat/courses/cs6431/zhuang.pdf](https://www.cs.cornell.edu/~shmat/courses/cs6431/zhuang.pdf) [0]

<comment><USER27> Do you think a phone call is high enough bitrate for these attacks, or are you implying parabolic microphones could be used to make this happen?

The mentioned paper contains a remark:

> While recording from the third keyboard, we get several seconds of > unexpected noise from a cellphone nearby.

But that's the only mention of a phone in the paper ...

<comment><USER26> I don't think the techniques and technology have become quite refined enough for this to be widely deployed, at most people are simply experimenting with the idea. But people are taking this seriously because it represents quite an attack vector once things fall into place. The thing is we won't know when we've reached that threshold until the first news stories about a widespread phishing scam using the technique emerge.

It seems VoIP will be the first low-hanging fruit: [https://arxiv.org/pdf/1609.09359.pdf](https://arxiv.org/pdf/1609.09359.pdf)

</comment></comment></comment><comment><USER28> On first read, I didn't understand how the call to the bank's customer service department went wrong.

 _Something about that conversation didn't seem right, and so Mitch decided to use another phone to place a call to his bank's customer service department — while keeping the first caller on hold._

 _"When the representative finally answered my call, I asked them to confirm that I was on the phone with them on the other line in the call they initiated toward me, and so the rep somehow checked and saw that there was another active call with Mitch," he said. "But as it turned out, that other call was the attackers also talking to my bank pretending to be me."_

What happened is that the attackers made one call to Mitch, and another call to the bank posing as Mitch. When Mitch called the real bank to check up if there was a call in progress, they said yes (the call with the attackers).

<comment><USER29> I don't know if I'm just really tired or if the post was just badly written, but I'll go with the latter since you were confused too.

My understanding is this happened:

1\. Attacker got a hold of Mitch's bank card, PIN, and some personal details.

2\. Attacker starts pulling out money and buying things here and there to see if Mitch ever notices.

Mitch never notices so...

3\. Attacker calls Mitch on Friday and pretends to be Mitch's bank. Attacker doesn't ask for any details, just alerts Mitch that something was going on with his account to get him to think the bank was looking into it.

4\. Attacker calls Mitch's bank and also Mitch at the same time the next day.

5\. Attacker asks the bank to send the SMS verification code to Mitch.

6\. Mitch gets the code and reads it back to the Attacker.

7\. Attacker repeats code to the bank.

<comment><USER30> I think it was perfectly clear.

</comment></comment></comment><comment><USER31> Side lessons seems to be that scammers have access to a lot of your personal info, which can fool you, and that you should never ever give an OTP over the phone.

<comment><USER32> One-time PIN for the curious

</comment></comment><comment><USER33> An anti nuisance call policy that has served me well and I try to get my folks to adopt is that if there is the merest hint of a delay between my hello and the caller's response, I put the phone down immediately.

I don't think I've ever had an identifiable repeat call, from which I conclude it's both effective and has a low false positive rate.

<comment><USER34> I take this a step further and don't say anything for the first few seconds if I pick up a call from a number I don't recognize. I used to not pick up those calls at all, but now that spam callers are using local area code caller IDs more and more, that is getting more difficult.

</comment></comment><comment><USER35> That's what I always told my older family.

If it is about finances, YOU call them at a number on your billing statement that you know is correct, or just go to the bank.

Never make a decision / give info if "they" called you.

</comment><comment><USER36> At this point, we should really throw away the current phone system and use an authenticated model. There should also be laws forcing the phone companies to not allow this. I get at least 2 spam/scam calls a day and there is no hope that it will reduce.

<comment><USER37> There are anti-spoofing requirements for carriers. The TRACED Act requires carriers to implement voice call authentication which should make spoofing caller IDs impossible. [https://www.congress.gov/bill/116th-congress/senate- bill/151](https://www.congress.gov/bill/116th-congress/senate-bill/151)

Last time I checked, carriers have until June 2021 to implement it. [https://arstechnica.com/tech-policy/2020/04/ajit-pai- follows...](https://arstechnica.com/tech-policy/2020/04/ajit-pai-follows- congress-instructions-requires-new-anti-robocall-tech/)

</comment></comment><comment><USER38> Does anyone know any good guides for being aware of these things, strategies used by scammers, and what to be suspicious of? Something that isn't patronisingly simple, but not aimed at teach expert users either.

> "But as it turned out, that other call was the attackers also talking to my > bank pretending to be me."

I don't understand this part - the _actual_ bank said that he was on a different line with them? Wouldn't that mean that the scammers had authorised as him already, in which case the account is already compromised? Also, the bank asking for 2FA over the phone also sounds like training into bad habits, but I appreciate there's different approaches with different banks.

This is a pretty similar sequence of events to one a reasonably intelligent but non-tech friend of mine fell for this week: Got an email saying that the TV licence needed to be renewed. They followed the link on the email, didn't check the URL and filled out their account details to set up a direct debit.

Two days later, gets a call from their "bank", telling them that they filled out a scam direct debit (gets victim flustered to compromise judgement) but they need to authorise them first before they can speak any further... my friend challenged their identity but they used the exact same "fake caller ID" trick - to the correct bank number since they had the sort code from step 1, and that identifies the bank. I knew this (caller ID) was possible in general, but hadn't heard of it being actively used in the UK - only from stories in the US. After "verifying" they asked for the 2FA device code, then (registered a card for ApplePay and) asked them to "confirm" the code they had just been texted, which is the point I walked in and was "WTF are you doing?"

About 10 minutes later while in the waiting queue for the actual bank, the actual bank called them - when we said that we wouldn't trust the call they instantly gave us a reference number to quickly recall the case and advised us to call back quickly. Luckily, the bank reimbursed the amounts taken before they locked it off (apparently some UK agreement from a couple of years ago.)

They were pretty shaken up from the experience, and want to know what to look for in the future. It strikes me that a lot of these cases are hitting otherwise reasonably cautious people who aren't aware that something they think is authentication, really isn't, like caller ID.

<comment><USER29> I think the attacker called the bank and Mitch at the same time. The attacker knew that the bank would send Mitch a SMS code so the attacker asked the bank to send it, Mitch told the attacker, the attacker told the bank.

The bank was on the phone with Mitch and the attacker at the same time. Mitch thought the "other Mitch" was himself on the other line.

</comment></comment><comment><USER39> Tips from my experience:

1\. If someone who calls you asks you for ANY sensitive personal info, just tell them that your policy is to not give any personal info to those who called you, but you're happy to call the official number. That stops it right there

2\. Use email aliases instead of your actual email when creating accounts with eg Amazon Web Services. An email alias is like firstname.lastname@example.com — this way the attacker can't get the customer service rep to give them access to your account easily.

3\. If you use your phone as a 2FA, be on the lookout for sim porting - that's when they trick the rep into porting your phone number.

I had the third one happen, luckily I acted fast. The attackers couldn't get into my G Suite email but they got into godaddy to port the domain and MX records to their servers. So they could receive email sent to me, and send email as me. They also changed my GoDaddy password. I had my phone as the 2FA at the time. Better to not have one at all, or use an authenticator app.

I called in and luckily GoDaddy restored my account. Too bad they had no tool to check what changed so I had to check every domain manually.

The attacker was too slow in that regard. But it was telling that I received an email with the subject "Test". That's what tipped me off.

</comment><comment><USER40> I've had this issue a few times with credit card companies, loan companies, and on one or two occasions collections agents. Some very nice person calls in order to discuss an issue with me, but wants me to tell them my birthdate, last-four-of-SSN, and other stuff "in order to verify your identity". They then act annoyed and puzzled that I won't just reel that information off to some rando who called me out of the blue, and start pointing to the caller ID as evidence that they're legitimate. The funniest part of the conversation is when they warn me that we won't be able to discuss this problem if I won't verify my identity, at which point I respond that _they_ called _me_ , so if they don't want to spend any more time on the phone, I'm happy to go back to whatever I was doing and they can try reaching me by some non-brain-dead means.

I feel like if we ran a public education campaign about how easy it is to spoof caller ID, a lot of these scams would stop working, but that's probably just me being foolishly optimistic.

<comment><USER41> Try calling chase. They'll tell you that they'll "call you back". They claimed that they would text me but the texts failed.

The guy claimed that "don't worry it's me". I told the guy that if you call me back to "talk about my account/verify me" you're going to be met with a "go fuck yourself". They do not have any protocols to confirm they are who they claim when they call back.

</comment></comment><comment><USER42> On landlines on some networks, it used to be that one person on the call hung up but the other didn't, the call would remain connected for a while. So if the person who had hung up, picked up the phone again, they'd still be connected to the same person, and wouldn't hear a dial tone. This was useful: if you wanted to move to a different phone connected to the same line, say, for more privacy, you just tell the other person what you're doing, hang up, and then pick up in the other room. But some scammers found a way to use this.

Basically, the scammer would instruct a suspicious mark to hang up, look up their bank's phone number, and call back, just as Krebs is instructing. As soon as the mark hung up, the scammer would begin playing a dial tone instead of hanging up. When the mark picked up the phone, they would hear the dial tone, so they would begin dialing at which point the scammer would end the dial tone, wait for the dialing to stop, and then play a few ring tones and then pretend to pick up the phone. This was in the 90s so the technology was there to automate it, but it's simple enough it could have been done completely manually by stopping and starting recordings. From the user's perspective, it seemed they had hung up and made a call to the bank, so it seemed impossible that they were connected to someone else.

Cell phones, which don't stay connected when only one party hangs up, are totally immune to this hack. And this hack has probably fallen out of use since the ubiquity of cell phones has deprived scammers of a viable pool of marks.

</comment><comment><USER43> Beware that there is also no-hang up scam. Below details are from wiki -

Another simple trick used by the fraudsters is to ask the called parties to hang up and dial their bank, but after the victim hangs up, the fraudster does not, keeping the line open and remaining connected when the victim picks up the phone to dial.[4] When in doubt, calling a company's telephone number listed on billing statements or other official sources is recommended, as opposed to calling numbers received from messages or callers of dubious authenticity. However, sometimes hanging up and redialing is insufficient: if the caller has not hung up, the victim might still be connected, and the fraudster spoofs a dial tone down the phone line to entice the victim to dial. Then the fraudster's accomplice answers and impersonates whomever the victim is trying to call.[5] This is known as a 'no hang-up' scam.[6] Hence consumers are advised to use a different phone when dialing a company's number to confirm.

When in doubt: hang up, look up, and call back "from a different number".

<comment><USER24> This seems like something that would only work on a landline.

<comment><USER43> True.

</comment></comment></comment><comment><USER44> I had a legit call a few months ago from the CRA (Canada Revenue Agency). He was nice enough and sounded calm, and I explained that with all due respect, since he called, I have no way of knowing if he is a scammer or not, so I'd like to call back. He was somewhat taken aback, but not annoyed. I asked where to call, and what to say to get to the matter at hand. After hanging up, I looked up the number, called them back, and got the issue settled. But I was truly surprised that he expected me to talk to him when he called. The CRA is probably the number one pretend-caller in Canada (Or two, after the RCMP - <USER3> federal police), so I was surprised they do not employ this as a standard practice and education for people to protect against scam calls. I was lucky to keep my wits about me, and that the call indeed was legit, but it shows there's a huge opening for scamming less savvy people.

</comment><comment><USER45> I was getting a bunch of those canada revenue scam calls a while back. They left a message with some robot voice saying 'there was a lawsuit in my name and blah blah blah blah bullshit' so I looked up the number and read about the scam. Apparently they'd actually managed to rip some people off and they were being searched for. So, the next time they called me, I called the number they left me. Some dude with a French accent answered. I started ranting. I told them if they ever called my number again I'd report them to the RCMP and swore a bunch and was fairly rude.

Funny enough, I never got a call back from canada revenue agency for, being less than polite to them, and the spam calls stopped.

My advice, if you actually get a real person on the line, call them out on their shit and tell them to fuck off. It seems to work.

<comment><USER46> Although satisfying, this isn't a good idea, they have your number and are capable of asymmetrical warfare eg spoofing your number for the next 10000 scam calls they make.

</comment></comment><comment><USER47> > Armed with a counterfeit copy of his debit card and PIN, the fraudsters > could pull money out of his account at ATMs and go shopping in big box > stores for various items. But to move lots of money out of his account all > at once, they needed Mitch's help.

Whoa, a double-tap attack

<comment><USER48> But how...

Isn't bank cards designed to be non-cloneable (with crypto chips)?

</comment></comment><comment><USER5> >But if your response to such a scam involves anything other than hanging up and calling back the entity that claims to be calling, you may be in for a rude awakening.

My response is not picking up the phone at all.

</comment><comment><USER49> I was recently scammed by either a man in the middle attack or a replay attack due to insufficient authentication of a new party I did business with.

When you are starting a new person to person transaction with an unknown party, it seems impossible to verify that an attack like this is not happening. The attacks could get arbitrarily complex and every defense I can think of has repucussions.

Even trying to start a transaction could be replayed to someone to make it look like I was the one that was doing the scamming.

</comment><comment><USER50> > The investigator said another man had called in on Saturday posing as Mitch, > had provided a one-time code the bank texted to the phone number on file for > Mitch's account.

Wow. In the UK as far as i'm aware no bank uses auth codes over txt, we have a physical devices to generate one time codes for identification or transaction signing using chip and pin.

Most people here are aware txt messaging is not secure, it's enough of an issue for email hijacking, I'm very surprised banks are using it in US.

<comment><USER51> Banks and brokers.

Sometimes a device is an option. Some organizations use a software token app on your phone, or something physical they send you.

</comment></comment><comment><USER52> > Mitch received a call from what he thought was his financial institution, > warning him that fraud had been detected on his account. Mitch said the > caller ID for that incoming call displayed the same phone number that was > printed on the back of his debit card.

Imho, this is where the phone company should be liable. If I let people masquerade as other users in my software, it would be a critical security bug and I'd be in deep trouble. But we just accept this crap from phone companies.

<comment><USER42> Your software probably isn't a multinational network of literally billions of pieces of hardware ranging in manufacturer and age by half a century, which isn't even owned and operated by a unified group of companies in a unified group of nations, which is used by all sorts of people in situations where its failure could cause people to literally die, so that changes have to be unequivocally backward compatible.

So there's that minor difference. If you decide to do a security upgrade and your software breaks, it probably doesn't mean that an 85-year-old woman dies because her only form of communication, a rotary phone, suddenly stops working and she can't get out of the house.

STIR/SHAKEN[1] is the solution to this problem, but the rollout is scheduled to be completed by June 2021 in the US, and September 2020 in Canada. It's slow, but this is something that you don't want to be rushed. Yes, I get it that Robocalls are terrible: I got 3 calls which I didn't pick up but I assume were robocalls today. But this upgrade is a difficult problem and the stakes are high.

[1] [https://en.wikipedia.org/wiki/STIR/SHAKEN](https://en.wikipedia.org/wiki/STIR/SHAKEN)

<comment><USER52> This prompted me to do some digging, and I learned something fascinating:

Caller ID and Email are just about the same age.

</comment></comment></comment><comment><USER53> I had someone claiming to be from my bank phone me in relation to certain transactions that actually happened, and like a fool I just answered their questions, without verifying who they were.

Later on I called back, to verify that it was someone from the bank who had phoned me.

The call-centre person in the bank who answered my call was unable to confirm or deny if someone from the transaction-checking department had actually phoned me, because it was all very confidential.

</comment><comment> grey-area How much time and money is lost to this kind of scam?

We need verified identity for phone numbers and email, with consequences attached to bad behaviour.

</comment><comment><USER54> There's basically no reason to ever answer a call from an unknown phone number, let alone engage and divulge private data. If it's important they'll leave a voicemail. Going further, I'd say it's basically safe to always block missed calls from unknown numbers that didn't leave a voicemail. If it's important, you'll hear about it via some other channel.

</comment><comment><USER55> Poor Mitch. The core of this sounds like another variant of the Mig-in-the- middle attack.

Page 126 (page 10 of the PDF) from RJA's Security Engineering being my reference...

[https://www.cl.cam.ac.uk/~rja14/Papers/SEv3-ch4-dec18.pdf](https://www.cl.cam.ac.uk/~rja14/Papers/SEv3-ch4-dec18.pdf)

</comment><comment><USER56> "He said he checked his account online several times over the weekend, but saw no further signs of unauthorized activity."

If, in retrospect, you feel someone was attempting to scam you, a better option - I hope - might be to contact the bank's fraud line, explain that you are suspicious, and have them look for suspicious activity.

<comment><USER29> Mitch was satisfied thinking that the bank was already looking into it, since the attacker pretending to be the bank didn't ask for any details /raise any flags.

<comment><USER56> For the point I am making, it does not really matter what Mich was thinking, but his behaviour over the weekend suggests that he was not entirely comfortable with the outcome. What do you suppose he was checking for? I would guess that he did not need to see his balance more than once.

He says that his suspicions were tweaked, near the end of the call, by the scammer giving an old address for him, and apparently his girlfriend was a good deal more suspicious: "Anyway, the whole time my girlfriend is sitting next to me listening to this conversation and she's like, 'This sounds like bullshit.'"

</comment></comment></comment><comment><USER57> Among many other things in this article, it's a good reminder to simply never use a debit card: use a credit card instead as the most you can be out is $50 for any incident of fraud. And if you need cash? How about going to the bank and talking to a teller (or going through the drive-through during social distancing)?

</comment><comment><USER58> So the scammers expected the victim to callback the bank to get the secret code? That is pretty sophisticated. But when they first called they knew about fraudulent discharges, and presumably had caused them, right? Or did they break into the victim's computer? Tbh., something is missing in that story.

<comment><USER29> I think the attackers had Mitch's bank card and PIN and was making those fraudulent charges to see if Mitch would notice. If he did, the attackers would have been shut out then and there.

Mitch didn't notice, so the attackers called Mitch pretending to be the bank. They didn't ask him for any details so no red flags were raised, they just said "we noticed fraudulent charges and rest assured we are fixing it."

Next day, attackers call the bank and Mitch at the same time. They needed the code the bank would send to the # on the account, so the attacker requested it from the bank, the bank sent it to Mitch, Mitch read it to the attacker, and the attacker repeated it to the bank.

At some point, Mitch got suspicious and called the bank to ask if they were on another call with him. The bank was on a call with the attacker pretending to be Mitch, so they said yes. Mitch thought the other Mitch was himself.

<comment><USER58> This is exactly what I meant. If the attackers already could make fraudulent discharges, then why should they put up such a complicated and risky attack? Could they not simply have gotten the money via the debit card?

<comment><USER56> Probably not anything like $9,800 dollars in one go - there's usually a daily limit. And the scammers may know (e.g. from doing it before) that after a few small transfers, the victim's bank will call him if he had not already noticed, in which case they preempted that call and effectively subverted it for their purpose.

The risk of the scheme not working might be high, but I am not sure that the risk of being caught is much increased.

</comment></comment></comment></comment><comment><USER59> This doesn't work for everyone, but if you can do it then it works well. Don't answer any calls from a number outside your contact list. If it is important, they will leave a message. You can then call them back by looking up their number on the website.

</comment><comment><USER60> This should also be a lesson about having $9k in an account tied to a debit card and not following up on suspicious transactions. If the thieves had done an ATM balance check and seen a combined balance of a number of hundreds of dollars that could be counted on one hand they likely would have settled for withdrawing that and wouldn't have bothered hitting Mitch with the advanced scam to gain the bank info needed for a wire transfer. If Mitch had noticed the test withdrawals he could have called his bank and stopped the fraud there.

For how often you need that kind of cash readily accessible it's simply not worth the risk for the overwhelming majority of people.

This was a really sophisticated attack and fooled even a security conscious person but defense in depth (not having the big bucks accessible from your general use card and/or following up on unknown transactions) would have stymied it. With a good security protocol breaking one rule (not hanging up and calling back) shouldn't screw you.

</comment><comment><USER61> How do these scammers hide their identities? Is there a tor network or some kind of proxy for gsm?

</comment><comment><USER62> VoIP has not been worth the billions in thefts that it has enabled via easy call id spoofing. I would happily give up VoIP to have restored trust in the telephone network. But unfortunately that is not where our captured regulators are heading.

<comment><USER63> That's interesting, I come to the exact opposite conclusion (I am admittedly not a telephone network expert, maybe I am missing some important things).

But I don't see why having voice conversations over the internet is the issue. The issue is these systems keeping compatibility with old telephone networks which prevents solving these problems. If we dropped that compatibility requirement we could require a certificate authority and be able to verify callers and use end-to-end encryption, just like with https.

Or maybe better would be a compromise where all these systems can still fall back to unencrypted/unsigned connections, but on any modern phone or cell phone it would show a big insecure warning like modern browsers do for http.

</comment></comment><comment><USER64> My problem with the whole thing is that even the companies doing it right aren't initiating it. They need to verify at their end first; and they need to initiate that.

This is our password & credentials, now please confirm your identity.

</comment><comment><USER65> Banks do this themselves too I think. I seem to have the recent memory where I called Chase, then they called me back. For the life of me I can't remember what I as calling about though

</comment><comment><USER66> How long until black hat SEO elevates the wrong numbers? If you search for Apple support, you already get ads for sketchy people in India that look like regular Apple support.

</comment><comment><USER67> It is 2020 and this prominent blog is not responsive for mobile device. You have to scroll horizontally to read at decent font size. Shame

</comment><comment><USER68> I have done this every time it involves money. Banks, Credit Companies, etc... don't let an incoming call end up with your money.

</comment><comment><USER69> If phone companies had any initiative or product brains at all, they would have initiated 'real caller ID' a decade ago.

</comment><comment><USER70> Especially with deepfake voices. That CEO instructing you to move cash right now might now because of an emergency...

</comment><comment><USER71> I've been in Intelligence and Law Enforcement for the better part of two decades and I put situations like this into the bin of:

If someone really wants your stuff, they are going to get it.

The cost of getting this guy's money was very high relative to the average scam - but it's important to note that the cost of sophisticated multi- factored scams is dropping.

</comment><comment><USER72> Maybe if banks and other companies didn't have a 10-level nested phone tree, we would.

</comment><comment><USER73> Well, do not call back overseas numbers or numberz that stat with 8

</comment><comment><USER74> I just: Don't answer, look up and maybe call back.

</comment><comment><USER75> I just don't answer. Haven't been scammed yet.

</comment><comment><USER76> Unknown number? Don't pick up in the first place.

</comment><comment><USER77> Anyone else notice that Krebs' site lacks TLS?

<comment><USER78> I get a 301 redirect to the HTTPS version. SSL Labs shows the site supports TLS 1.0 - 1.3. [https://www.ssllabs.com/ssltest/analyze.html?d=krebsonsecuri...](https://www.ssllabs.com/ssltest/analyze.html?d=krebsonsecurity.com)

</comment></comment><comment><USER79> shouldn't be banks liable for providing those security code to a stranger if it can be proven they were tricked?

</comment><comment><USER80> TL;DR: Always hang up, look up, and call back.

</comment><comment><USER81> > he quickly logged into his account and saw that there were indeed multiple > unauthorized transactions going back several weeks. Most were relatively > small charges — under $100 apiece — but there were also two very recent $800 > ATM withdrawals from cash machines

How is it possible for someone not to check his/her bank account all this time? There were unknown transactions for several weeks and no one noticed?

IMHO not having alerts for your cards/accounts and not noticing strange transactions is a bigger security risk than trusting the telephone number calling you.

I fully agree that we should call back on the official number for any banking issues and don't blindly trust whoever is pretending to be from the bank.

<comment><USER82> Most people I know check their credit card, debit card, and/or bank statements once a month, if ever.

You and I are the outliers, my friend.

<comment><USER83> Count me in. Text alerts on all financial institutions to a google voice # and monthly reconciles of all acounts plus weekly investment checks.

I have had two fraudulent CC charges in 25+ years, and they both were reversed immediately so I'm not worried about that. More worried about my credit union so I keep as little in there as possible. (Interest rates are a joke so it doesn't matter.)</comment></comment></comment>


Confessions of a "Stroke Surgeon" [video] - <AUTHOR> https://www.facebook.com/SeattleScienceFoundation/videos/526470751515165/ <comment><AUTHOR> This neurosurgeon talks about his experience learning the craft, why his location in Memphis is a geographic hub of stroke treatment (1m45s), mistakes the industry makes (6m0s), and treatments that were based on expected outcomes but didn't work out. It's fairly accessible to laypeople.

</comment><comment><USER2> Wow. I normally don't go for video's, but I'm glad I looked at this one. This is master craftsman porn - one of the top guys on the planet talking about his craft.

</comment><comment><USER3> Wow. Amazing lecture and visuals. Just stunning.

</comment><comment><USER4> A great find</comment>


Instagram is so popular, but I stopped using it - <AUTHOR>

http://techcrunch.com/2011/11/27/why-instagram-is-so-popular/ <comment><USER2> a text link?

<comment><USER3> I guess it was already submitted and HN picked it up, so he tried his luck this way. :)</comment></comment>


Facebook hires Vladimir Vapnik, father of the support vector machines - <AUTHOR> http://venturebeat.com/2014/11/25/facebooks-ai-team-hires-vladimir-vapnik-father-of-the-popular-support-vector-machine-algorithm/ <comment><USER2> Between Google, Facebook, Microsoft, Baidu and Yahoo the Machine Learning field is becoming privatized. I just hope they continue publishing their findings.</comment>


Cata-list: Useful lists of some of the best info, media, tools, and quotes - <AUTHOR> https://cata-list.github.io <comment><AUTHOR> Creator here. I've been lurking on Hacker News for a while and often add useful and interesting articles and tools which I find here to my lists. I hope and imagine that any who resonate with the Hacker ethic [1] and/or seek to be/create catalysts for positive change may find some interesting and potentially useful things.

[1] [https://en.wikipedia.org/wiki/Hacker_ethic](https://en.wikipedia.org/wiki/Hacker_ethic)

Quick example links/pages:

News / Timeline: [https://cata- list.github.io/articles/timeline/2020](https://cata- list.github.io/articles/timeline/2020)

Media / Books: [https://cata-list.github.io/media/books](https://cata- list.github.io/media/books)

Media / YouTube: [https://cata- list.github.io/media/youtube/academyofideas](https://cata- list.github.io/media/youtube/academyofideas)

Tools / Science: [https://cata-list.github.io/tools/science](https://cata- list.github.io/tools/science)

Quotes / Ralph Waldo Emerson: [https://cata- list.github.io/quotes/emerson](https://cata-list.github.io/quotes/emerson)</comment>


NoteSlate /// intuitively simple monochrome paper alike tablet device - <AUTHOR> http://noteslate.com/ <comment><USER2> Dupe: <http://news.ycombinator.com/item?id=2180623>

<comment><USER3> This is different than the original post. They've really fleshed out the website; two weeks ago, it looked like a fake. Now, it looks like a more legitimate product than before.

(Of course, a thorough website doesn't prove anything.)

<comment><USER2> All I see is a bunch of HyperShot photorenderings.</comment></comment></comment>


Apache Superset is an enterprise-ready business intelligence web application - <AUTHOR> https://airbnb.io/projects/superset/ <comment><USER2> I don't think superset is "enterprise ready". It is an extraordinarily powerful tool, but it's sitting in a niche. Allow me to offer some criticisms from our experience.

The setup process for SuperSet involves a 100 fragile tiny OS components, so the only viable object is the docker image and the security risks associated with giving an image unfettered access to your data in an environment where updating CVEs for individual components will break the application.

Then once you have it installed, the setup process with your datamodel is also time consuming. If you make it past that, the UI has a steep learning curve that will turn away non-technical users.

Compare that to the likes of Metabase. Download the jar. Download a JVM. Start it with java -jar metabase.jar Point it at your database. It automatically goes and creates a data dictionary for you. It's smart enough to figure out which fields are relevant. It comes with a built in data browser. It has a WYSIWYG query editor. It allows for instant sharing of questions and dashboards. It has fallback to questions written in SQL.

I really hope they can improve on all of these things, but it's a complex project with a very large codebase.

</comment><comment><USER3> Been using metabase at our org, similar type of project - finally getting "less technical" users to look there to answer their own questions.

The likes of superset, redash & metabase are awesome - would recommend all three to any org.

<comment><USER4> If I only want to use one, which one is the best? Plugging into standard PostgreSQL with few hundred millions of records

<comment><USER5> They all have their strengths and weaknesses. Having used all three, I'd start with Metabase. It's super easy to setup and I'd argue it has the most intuitive interface for non-technical end users.

</comment></comment></comment><comment><USER6> Here is a tutorial on how to use Superset and Dremio to visualize data from multiple data sources. [https://www.dremio.com/tutorials/dremio-apache- superset/](https://www.dremio.com/tutorials/dremio-apache-superset/)

</comment><comment><USER7> the commercial version: [https://preset.io/](https://preset.io/)</comment>


Show HN: Hacker's Doorbell - <AUTHOR> http://github.com/joer14/hackers-doorbell <comment><USER2> > _Also, a warning, there is no rate limiting with this simple app so it 's > pretty easy to get DOSed by a funny coworker._

No it's not. It's impossible for a funny coworker to DOS you with this, because anyone who uses this to DOS someone is not funny.

<comment><AUTHOR> Nah it's actually pretty funny in a juvinial way. Don't forget to play sometimes</comment></comment>


How to Teach People SQL - <AUTHOR> https://dataschool.com/how-to-teach-people-sql/ <comment><USER2> Thanks for posting on Hacker News. I wrote this free web book after working with many students online. Would love to answer questions and get feedback</comment>


How The Pentagon's Reaction To Wikileaks Is Like The RIAA's Reaction To Napster - <AUTHOR> http://techdirt.com/articles/20100806/02073410521.shtml <comment><USER2> Except that lives are at stake instead of money. Not that I believe that this endeavor in Afghanistan makes sense.</comment>


"Google now suggests placing CSS links AFTER the closing HTML tag?" - chestnut-tree https://twitter.com/pearsonified/status/460468430747881473 <comment><AUTHOR> Link to actual article: [https://developers.google.com/speed/docs/insights/OptimizeCS...](https://developers.google.com/speed/docs/insights/OptimizeCSSDelivery)

from what I can tell, it is focusing on inlining css, not placing the <link> below the <html> tag.

</html> <link> is invalid, but testing </body><link></html> IS valid. my guess is that the docs have a typo.</comment>


Apple Brings The App Store To Twitter Promising Exclusive Offers - <AUTHOR> http://techcrunch.com/2011/01/24/app-store-twitter/

<comment><USER2> I don't understand how this is newsworthy or interesting. The iTunes Store already broadcasts special offers via Twitter, why wouldn't the App Store also do that sooner or later?

Broadcast-only Twitter accounts (which all of these are) are boring and don't deserve this kind of attention.

(The article also contains a confusing error. It's not "Twitter executives" who were "joining in on the fun" but Apple executives.)

<comment><USER3> But it's Apple!</comment></comment>


Ask HN: Best places to ask "please review my startup?" question? - <AUTHOR>

HN is a great place for that - but do you know any other good places with people that feedback is worth reading/considering? <comment><USER2> <http://discuss.joelonsoftware.com/?biz>

<comment><AUTHOR> Looks like a high traffic site that I haven't heard of. Thanks for the tip!</comment></comment>


How your brain actually makes decisions while you sleep - <AUTHOR> http://www.washingtonpost.com/posteverything/wp/2014/09/17/your-brain-actually-makes-decisions-while-you-sleep/?hpid=z12

<comment><USER2> [https://hn.algolia.com/?q=decisions+sleep#!/story/forever/0/...](https://hn.algolia.com/?q=decisions+sleep#!/story/forever/0/decisions%20sleep)

<comment><AUTHOR> Looks like the Post is appending a query parameter to the url that's foiling your dupe detection. I usually notice these and strip them out, but not this time.</comment></comment>


Free Logo Friday's - <AUTHOR> http://free-logo.wadehammes.com/

<comment><USER2> Awesome! I so want to apply for this, but cannot get the entry form to work. It says I didn't fill out all the required fields (but I did).

<comment><USER3> Your winners page is broken for me -- Chrome Ubuntu Linux, but looks ok in Firefox.

<comment><AUTHOR> Weird you are right! I didn't notice it because it has been working for me, but just checked it in IE...whoops...I think there needs to be a clear in there somewhere. Ill go look.

<comment><AUTHOR> fixed.

</comment></comment></comment></comment><comment><USER4> Plurals don't require apostrophes. It's just "Fridays".

<comment><AUTHOR> I am not seeing where I used it, can you point it out?

<comment><USER4> Title of your HN submission :)

<comment><AUTHOR> haha whoops, that's late night submitting for ya!!

</comment></comment></comment></comment><comment><USER5> This is not awsome, he's whoring himself out for Facebook and Twitter followers — and while doing it he's undermining design professionalism.

<comment><AUTHOR> Not really, I am also bringing on Guest Designers to do weeks as well. Say you are an up and coming designer, what better way to get your name out than doing something that costs the end user nothing, and if they like it, its free publicity! This isn't about me...I am not a professional designer, I just had an idea, and want to help people out! Sorry you feel this way!</comment></comment>


Cisco Wants To Rule Your Living Room - <AUTHOR> http://siliconangle.com/blog/2010/03/05/cisco-to-announce-apple-google-tivo-killer-set-top-box-plus-a-new-high-speed-network-are-they-now-competing-with-google-apple-and-skype/

<comment><USER2> _"Is there high bandwidth that will appear out of "thin air"? "_

Yes but it's actually been there the whole time. You know it as broadcast analog TV channels and inefficient MPEG2 digital video. Even a modest cable system can pump a massive amount of data into your home with the right hardware. If Cisco wanted to get aggressive on pricing for infrastructure products we would see a huge increase in bandwidth very quickly.</comment>


Evolution Can Go Fuck Itself - <AUTHOR> https://mindlasers.com/evolution-can-go-fuck-itself/ <comment><USER2> I can't help but share your feeling. It's quite interesting how naturalism just mentions the parts that they like about evolution and hide actually how horrendous the thing actually is. Is not my intention here to promote alternative explanations to our origin or anything like that, but if we really believed in evolution, why do we try to get the women/children/handicap out of an accident first when who should survive is the fittest? And if I dare go to even darker terrain, having a superior race take over the world would just advance evolution positively (I ABSOLUTELY ABHOR THE IDEA!)

But then, why do we find ourselves in such strong revulsion against what is supposed to just be? If this (evolution) is all that there is and has ever been, how do we, as a part of it, "know better"?

<comment><USER3> > why do we try to get the women/children/handicap out of an accident first > when who should survive is the fittest?

This is pretty much the problem of why evolution encourages altruism, why there are eusocial animals (ants, bees, naked mole rats) and things like that.

You're missing 2 things:

1\. "fittest" isn't very obvious. It probably comes down to something like a statistical ability to have offspring that survive. With that orientation, saving women/children/etc first makes sense: more offspring survive, especially for K-strategy species like humans. We humans are accustomed to making moral judgements about survival, but experts seem pretty sure that "fittest" doesn't include morality. Just as a side note, "fittest" may not exist as a long term thing. Climates change, continents move, volcanism happens. "Fittest" might mean something on a short term, but probably doesn't exist long term.

2\. What nature wants to propagate isn't terribly obvious. It's chromosomes. Why do you help your children? They carry half of your chromosomes. Why do you help your parents? Same reason? Your sibligs? On average you've got maybe 50% of your chromosomes in common. See [https://quoteinvestigator.com/2016/05/05/brothers/](https://quoteinvestigator.com/2016/05/05/brothers/) for a pithy way of saying this.

Propagation of chromosomes pretty much explains colonies of ants: because of the way sexual determination works in ants and bees, the worker ants are more closely related than mammal siblings are. This article has a decent explanation: [https://www.antkeepers.com/facts/ant-colony/why-do-ants- live...](https://www.antkeepers.com/facts/ant-colony/why-do-ants-live-in- colonies/)</comment></comment>


Drag out files like Gmail - <AUTHOR> http://www.thecssninja.com/javascript/gmail-dragout <comment><USER2> Does it seem sort of Microsoftish that Google uses an undocumented API to their own benefit without letting the rest of the community know?

<comment><USER3> There's a bit of difference: there's an open-source version of Chrome which presumably has a fully-commented source code implementation of this feature, together with a public bug tracker, etc.

<comment><USER4> The files are here: [http://src.chromium.org/svn/trunk/src/chrome/browser/downloa...](http://src.chromium.org/svn/trunk/src/chrome/browser/download/)

drag_download_file.cc: [http://src.chromium.org/svn/trunk/src/chrome/browser/downloa...](http://src.chromium.org/svn/trunk/src/chrome/browser/download/drag_download_file.cc)

drag_download_file.h: [http://src.chromium.org/svn/trunk/src/chrome/browser/downloa...](http://src.chromium.org/svn/trunk/src/chrome/browser/download/drag_download_file.h)

drag_download_util.cc: [http://src.chromium.org/svn/trunk/src/chrome/browser/downloa...](http://src.chromium.org/svn/trunk/src/chrome/browser/download/drag_download_util.cc)

drag_download_util.h: ttp://src.chromium.org/svn/trunk/src/chrome/browser/download/drag_download_util.h</comment></comment></comment>


Maine growers cultivate gourmet mushrooms - <AUTHOR> http://www.mainebiz.biz/article/20170710/CURRENTEDITION/307069995 <comment><USER2> Maine is trying to diversify to highly valuable farmed goods i.e. oysters, mushrooms... and of course legalization has created a stir...</comment>


Profile: Martin Gardner, the Mathematical Gamester (1914-2010) - <AUTHOR> http://www.scientificamerican.com/article.cfm?id=profile-of-martin-gardner

<comment><USER2> Thanks for this - I particularly appreciate the information. Here are some other items, some with comments:

<http://news.ycombinator.com/item?id=1371335>

<http://news.ycombinator.com/item?id=1371637>

<http://news.ycombinator.com/item?id=1372045>

<http://news.ycombinator.com/item?id=1372976>

<http://news.ycombinator.com/item?id=1374007>

</comment><comment><USER3> From the Times obituary:

In fact he was so old his age was the largest number with only two factors, where the two numbers below it also have only two factors each.

This is a tremendous loss, I don't know anyone who can fill his shoes.</comment>


[JavaScript] experience of migrating from MongoDB to PostgreSQL - <AUTHOR> https://medium.com/@holdfenytolvaj/javascript-experience-of-migrating-from-mongodb-to-postgresql-21f8bf140c05#.wjdh6dfzq <comment><USER2> Why didn't you use PostgreSQL's uuid type? PostgreSQL ships with several different functions for generating uuids.

</comment><comment><AUTHOR> Disclaimer: It is relatively a small user base project (not MongoDB primary audience), but hope you will find some interesting details.

Thanks for reading ;)</comment>


Hushmail Backdoors - <AUTHOR> http://themonetaryfuture.blogspot.co.uk/2009/05/pgp-creator-bolts-to-hush.html?showComment=1309018784191#c7610754517237372617 <comment><USER2> Hushmail was always a strange operation to me anyway. If you need data at rest encrypted, why trust a third party with the keys? If you need anonymity, why would you want a key identifying your unique persona?

<comment><USER3> You could say that about a lot of cloud based products... Think of the information in gmail or salesforce.com. The value those tools provide and the flexibility vs the risk of them improperly using your data and the cost of running them yourself (likely running them improperly too.). That's the cloud.

What is more interesting is what the EULA said about this sort of thing and if they hand data over without notification to the owner. I suspect that they did.

<comment><USER4> No, it's different. Hushmail is specifically a _security_ product so it's a much bigger deal that it is inherently less secure than the alternatives.

<comment><USER5> What alternatives? How is it any less secure than another mail host?

<comment><USER2> The whole point of Hushmail is that you can use PGP/GPG style mail encryption via a webmail interface. You could also do this anonymously. They claimed that it was secure because the PGP stuff was done via a Java applet. It turns out that

If you have a use case for using content signing and encryption, using a closed-source Java or other web applet is a pretty weird way to address it.

</comment></comment></comment></comment></comment><comment><USER6> The team behind outlook.com says thanks. :P

Now it's time to put pressure on Microsoft to implement two-factor authentication and native PGP support.

</comment><comment><USER7> WOW, makes you wonder. Digitaly signed and hashed javascript verification certianly has a market it seems.

<comment><USER4> Uh, I guess. Why bother using javascript at all if you need some non- javascript tool to verify it everytime you use it? Might as well just use GPG along with any existing mail service.

<comment><USER8> One thought is that you can get PGP functionality from a portable service. If you brought the javascript with you on a USB drive, you could use it from computers that were not your own.

Of course you could also install Thunderbird portable on your USB drive and implement your suggestion as well.

<comment><USER9> Why would you ever put your private key within reach of a computer that is not your own?

<comment><USER8> Travel, work, government exile in hiding.

Lots of reasons. If encryption is ever to become widespread, it needs to accomodate the myriad of situations that users might need computing/communication in. Which is a lot.

<comment><USER10> I've seen this implemented (in a very special case) with statically-linked GPG on a USB drive and a Crypto Stick[1]. Better than JavaScript (because you don't need to rely on an untrustworthy interpreter), and the keys never leave the smart card. The big limitation is that you need admin access to the system if you need to install drivers for the smart card.

[1] <http://www.crypto-stick.com/></comment></comment></comment></comment></comment></comment>


Ask HN: Please review my side project i.crowdfunded.it - <AUTHOR>

http://i.crowdfunded.it
Basically it's like a kickstarter for stuff.  Right now i am just using Amazon.
How It Works

  1. Search

  2. Put stuff in cart

  3. Crowdfund it

  4. People pitch in

  5. Item is shipped once fund is complete
 <comment><USER2> Since I'm at the age of where my friends are getting married or having babies, I can see this being useful for the really expensive gifts on wedding registries or baby showers. Heck, it could even be useful for contribution towards a honeymoon for friends who can't afford it after their costly wedding!

<comment><USER3> I agree. I can easily visualize the pitch to business who offer registries (wedding, engagement, baby shower, graduation) as an alternate method for payment. It makes it simple for people who want to collaborate on gift purchases but who might live in different cities/states. The UI is simple, usinge SM networks to connect ppl looks easy, service is appealing you don't plan to add a charge for the service. Heck, I'd use it!... hope you get funded!

</comment></comment><comment><USER4> excellent. I will use this. Two items about your video: (1) you didn't discuss how to add friends/how to broadcast this fund request, and (2) the video loops.

A++ on design and simplicity.

Does the site take a % of the funds - this should be clearly stated. Local sales tax are not included in total cost of the item(s).

note: I logged in via Twitter, added xbox and checked out - got a generic error. Guess some bugs still there?

<comment><AUTHOR> Nope, I take 0%. The only way I make money is by being an affiliate; thats why I am only using amazon right now.

</comment></comment><comment><USER5> How it works page is needed but apart from that. A nice side project indeed.

<comment><AUTHOR> I just put up a homepage and I am putting up a screen cast / how it works right now. Let me know if this helps.

</comment></comment><comment><USER6> Who pitches in? Friends? Family? How do they pitch in?

<comment><AUTHOR> Anyone can pitch in. When you checkout it creates your funding page and people visit that page to pitch in.

<comment><USER6> Can you send me to a sample funding page? What happens to the money if you get your item partially but never fully funded?

<comment><AUTHOR> You can create one and the user can change their item to an item of lesser value after their fund has entered "inactive" status.

<comment><USER6> On the checkout form, I think that you should have the zip code field prefill the city, state, and country fields. Or explicitly limit to US only. I think that people will wonder why you're not asking for their full address, most people don't know you can get city and state data from their zip.

The enlarged radio buttons don't look good on Firefox 7 Mac. In general radio/list/select fields not not scale well.

The 3% fund from you is a nice touch.

There needs to be a link which you can share with other people to help fund your purchase on the account page. Don't see a link.

<http://i.crowdfunded.it/crowd_members/?id=4> Does not work.

"You currently have 0 completed funds. " Should be at least 1, right?

I like the idea just needs a little more polish and a lot more pitch. To be honest I just don't trust the service in it's current state.

<comment><AUTHOR> Thanks for the feed back. <http://i.crowdfunded.it/apple-ipod-shuffle-2-gb- silver> is the page people use to pitch in. you can click the fb like, google +1 or tweet to share with others so that they can pitch in. Trust is definitely important here. How do you suggest I improve on that?

<comment><USER7> Shouldn't that page say to whom I am giving money?

I think it's a nice concept. People will perhaps be more inclined to give if there was some sort of feedback mechanism. Something that will tell a complete stranger that the guy who was an ipod shuffle for his birthday deserves my $5. Perhaps if I knew that this guy gave $10 to someone else last week for a school textbook? Just thinking out loud.

<comment><AUTHOR> I cant believe I missed that. Thats a very good idea.</comment></comment></comment></comment></comment></comment></comment></comment>


Show HN:App to Connect with YC Alumni for advice on YC Applications,interviews - <AUTHOR> http://mentr.io/yc.html <comment><AUTHOR> Hey HN, I am Nishant Asthana, Co-founder and CEO of Mentr (mentr.io) Mentr is a marketplace for high school students to get 1-on-1 college advice, essay reviews and tutoring from verified College Students online. More than 200 students from top US colleges have helped thousands of high schoolers. We applied to YC W17 batch. While writing the application we felt a need to find an easy way to connect with YC Alumni for their feedback and advice. Using our platform, we created this app for us and for all the applicants who may find it useful. The Instabug team has joined the community of founders. I request more YC founders to join. Really appreciate the feedback and I am available if anyone has any questions. firstname.lastname@example.com \- Nishant Asthana</comment>


Show HN: A debate website - MVP - <AUTHOR>

Hey guys it would be wonderful if you could review my new website at idebate.me. It is a debate website and built it because this niche is quite empty and wanted  place where i can thrash out topics with others. The development of the full version was stopped after reading about building a minimum viable product. This is the MVP and if people are interested in the space i would upload the remaining features.<p>Check it out and review it. <comment><USER2> Clicky: <http://idebate.me>

I clicked on one of the debates, to see how it was... but got prompted to sign in. Can I not just, look at it? What if the argument was so good, that I just _had_ to reply?

Also, the place is horribly bare... that will turn a lot of people off.

<comment><AUTHOR> Done!! you can now view the debates

<comment><USER2> Awesome. Much better. Just one question, what's up with the Yes I agree, Nah!, I don't agree? Surely just a "Post opinion" is a better aspect?

</comment></comment></comment><comment><USER3> Much like veb's experience, I went to check it out and couldn't even view a debate without signing in. I proceeded to close the page. I enjoy debate websites, and I used to frequent essembly before it died. But, I'd like to be able to casually browse the ongoing discussions there without having to sign in.

<comment><AUTHOR> You can view the debates now without regsitering

</comment></comment><comment><USER4> Interesting, not long ago I was in search of such a site and thought about building my own. Eventually I found this site (basically the same as your site from what I can deduce), which I've found isn't great (mostly because of lack of participation though): <http://www.convinceme.net/>. How will you distinguish yourself?

Seems to be a good start though. I understand it's a MVP, but with the design of the site currently I don't know where my eyes are supposed to go on the debate page. What's the main focus? Where should it be?

<comment><USER5> I like convinceme.net but the traffic on compete.com is horrible. I hope it could do better and I think it deserves better attentions.

I personally don't get the quora hype, but I would understand if Convinceme get more popular

</comment></comment><comment><USER6> I would try and add a bigger twist to standard x vs y poll to separate yourself. The basic concept has been done many times before, without massive success.

USvsTHEM (<http://usvsthem.com>) is a site that I co-created - and still very early alpha; but adds a twist that centers a debate around people and their network of support. There is no browse-able stream yet, as the alpha release was meant to test the social utility.

Good Luck!

<comment><USER7> USvsTHEM also allows you to send and receive debate challenges with Twitter, which is a neat convenience.

</comment></comment><comment><USER8> why do I need to register to vote? Why can't I just upvote. (At least provide facebbok/ twitter login. There is tremendous inertia before I go through any new sign ups)</comment>


How small companies and freelancers can deal with the VATMOSS EU VAT changes - <AUTHOR> http://rachelandrew.co.uk/archives/2014/11/25/how-small-companies-and-freelancers-can-deal-with-the-vatmoss-eu-vat-changes/ <comment><USER2> The benefit and one reason for this new regulation is to enable digital download businesses to be able to compete wherever they are located within the EU. I used to run a digital download service for record companies and we had a serious disadvantage against Luxemburg registered companies like Apple since we had to add 25% VAT and they only had to add 15%.

<comment><USER3> I'm pretty sure that for smaller companies the overhead and added complexity erases any benefit of a more competitive price. Just look how many people are considering not selling to customers in other member states.

Which is btw the exact opposite of what EU was supposed to promote. Doing business within EU should be simpler so that we could compete against companies operating in the unified American market.

<comment><USER4> That is right. At least, they should have promoted the minimum amount to be taxable (I don't know the right English word) to the new system. In the old system, smaller businesses which did less than amount x business could be excluded from the taxation. They should at least have a small amount left for real small businesses that have few foreign customers .... So, a business owner must decide, if he takes the hassle for one or two customers or just says that he takes no foreigners at all!

They could have said, that business with less than X "foreign" income could still comply to their own countries taxation ... but no, with such a thing, they just created more bureaucracy and support the big players like Amazon, against which the regulation should have gone in the first place ... (at least, that was the explanation).

</comment></comment></comment><comment><USER5> Of interest to any UK businesses below the normal VAT registration threshold who were going to be forced to register for and charge VAT to UK customers just to comply with the new rules for other EU sales:

[http://www.telegraph.co.uk/finance/businessclub/11268706/Vic...](http://www.telegraph.co.uk/finance/businessclub/11268706/Victory- for-UK-micro-firms-as-HMRC-tweaks-EU-VAT-MOSS-rule.html)

</comment><comment><USER6> It's a few links deep into the article, but Rachel has also been compiling a list of companies that can deal with all of the VAT hassle for you. They'll take a percentage cut, but it could be worth it to not have to deal with bureaucracy & paperwork:

[http://rachelandrew.github.io/eu-vat/third- parties.html](http://rachelandrew.github.io/eu-vat/third-parties.html)

</comment><comment><USER7> Recurly ([https://recurly.com/](https://recurly.com/)) have done a great job to quickly roll out all the features and reporting required for us to be compliant with these changes by the 1st Jan. I'm not aware of any other payment provider that this is true for (but I haven't looked very hard.) They've made it very easy for us.

</comment><comment><USER8> I think the hack of sending out a physical item with free digital download is a great way to bypass this ridiculous EU garbage. A colleague who has some paid for digital content just started to do this last week and the customers seem quite happy about it.

<comment><USER9> Uh, so he collects physical address, location info and deals with all the physical shipping costs just to avoid a single database lookup of a VAT %? O.o

Wat?

<comment><USER10> The taxes has to be handed in as well, not just charged on the customer. So not only do you need to do the database lookup, you also need to wire the money and fill out any paperwork the customer's country-of-purchase requires.

<comment><USER11> That's assuming you don't go down the MOSS route, where "any paperwork" is likely to be over a hundred different sets of accounts each covering a subset of transactions, submitted to dozens of authorities in different languages that require you to have authenticated yourself to the individual countries.

Even if you do MOSS it's still not one database lookup. For one thing, you need to get current VAT rates in the particular state that the customer is coming from, which is a significant amount of work just in making sure you're billing people correctly. A good e-Commerce platform will let you use complex tax rules but you still need to make sure that the users are linked to the correct country. If a user comes in, picks Luxembourg as their place of residence rather than Denmark and notices they're saving €30, they're likely to lie about which country they're in. You're required to collect and retain evidence about your supplies, so you end up in the situation where you're having to trust GeoIP to save you from customers looking for a discount at the expense of your tax records.

</comment></comment></comment></comment><comment><USER12> How much time and money are europeans spending on this? the best way to deal with this is not having it in the first place. VAT itself is a really bad idea.

</comment><comment><USER13> Good to see this getting more publicity. The lack of a small business exemption is potentially devastating.

<comment><USER4> I totally agree. I also wrote my own opinion as answer to another post.

The regulation should in the first place go against the big players like Amazon .... but such badly as it was done now, it hurts the small businesses and start-ups. Another reason, that Europe is bad for Entrepreneurs!

</comment></comment><comment><USER14> Stupid question, but I assume that if they say EU, this does not apply to sellers based in Switzerland?

</comment><comment><USER15> For us, this is looking like it won't be too bad after all. We have some kind of shell company or subsidiary or something like that in the UK that all our EU sales go through, and it is registered for VAT in the UK, so we just need to add MOSS registration. Right now, we just collect the 20% UK rate, but our backend was designed to handle different rates for different countries--I just need to add rows for each country to the tax table.

We already ask for a billing address when a customer orders, and record the IP address, and we already do a location lookup by IP address on our cart, so we'll just need to check that there is a match, and do something to deal with it if there is not. I expect there will mostly be matches.

I took a look at our existing customers. Only about 0.1% did not have an IP address on file that matched the country they gave for their billing address. Most of the ones that did not match had a telephone number on file, and the telephone number appeared to be in the country of their billing address.

That raises a question. Suppose a new customer orders online, giving France as their country. Their IP address is also in France, at least according to the ip => location database you have. That's two pieces of non-contradictory evidence for France, and so you are good to go.

Are those two pieces of evidence only good for that particular sale? If the customer comes back a few months later and purchases again, again giving a French billing address but this time coming from a German IP address, can I use the French IP address from the first order and the French billing address from this order as sufficient evidence to again charge French VAT?

The VAT is supposed to be for the place the customer permanently resides, so for instance if that customer lives in France but is on vacation in Germany I'm supposed to charge French VAT. Billing address is much less likely to change during a vacation than IP address, so a person with two orders with French billing, and one French IP and one German IP, is probably far more likely to be a French resident temporarily in Germany than someone who has moved to Germany.

So, from a logical, common sense point of view, I'm inclined toward going with the customer's stated billing address country if they have any IP addresses from that same country among their last few orders. Logical and common sense don't alway match the law, though.

Another question is how to handle telephone sales. No IP address on a telephone sales. Figure it out from their phone number? Ask them to go to their computer and go to a page of ours, enter a number that the salesperson tells them, and hit "submit", and get an IP from that?

<comment><USER16> FYI, there are other issues you need to be aware of beyond the country look-up and location checks.

For example, you need to watch out for which currency you charge in vs. which currency you pay tax in, and how you calculate the exchange rates if these differ.

Another possible problem area is relying entirely on a country code to determine which tax rate to apply. Sometimes islands or other secondary locations might use the same country code as their "home country" but have different tax rules.

Then there are the data protection implications. I've seen several sources you would expect to be reliable today, and even those don't seem to agree on whether or not the requirements to keep location data for 10 years will mean businesses that were otherwise not required to register with the local data protection authority will now have to do so.

No doubt more catches will be identified as the panic continues over the next few days...</comment></comment>


Mamba Mentality (2018) - <AUTHOR> https://www.theplayerstribune.com/en-us/articles/kobe-bryant-lakers-photos-andrew-bernstein <comment><USER2> I was reading an article just the other day about Kobe talking about how he'd memorized the referees handbooks about where they were supposed to be on the floor for given player positions/times/etc, and how he would use that to be in the blind spots. (in fairness probably some level of exaggeration there, but given his stats and the way he got calls/no calls to go his way so much more often than not, there is something to it)

The man had an exceptional level of focus for his craft, and he paired that with natural talent and hard work to become a legend on the court.

"I made a point of reading the referee's handbook. One of the rules I gleaned from it was that each referee has a designated slot where he is supposed to be on the floor. If the ball, for instance, is in place W, referees X, Y, and Z each have an area on the court assigned to them. ...When they do that, it creates dead zones, areas on the floor where they can't see certain things. I learned where those zones were, and I took advantage of them. I would get away with holds, travels, and all sorts of minor violations simply because I took the time to understand the officials' limitations."

<comment><USER3> another explanation on why he gets away with stuff is just that he's kobe (skilled and a top marketed player).

i know lebron isn't reading the handbooks, and he can walk from half-court on a break away fast break without getting a travel call. that's because he's lebron (can't dribble and is a top marketed player).

<comment><USER4> That doesn't really happen. In fact Russell Westbrook, an MVP in his own right, did it and got called for it.

[https://www.youtube.com/watch?v=lm0t31ZNQIQ](https://www.youtube.com/watch?v=lm0t31ZNQIQ)

<comment><USER3> is that example really showing what you mean to show? i have seen it many times before. just note how insanely long it took to make that call. there's somewhere between five and seven steps before the whistle was blown.

> That doesn't really happen.

unless you're joking.

</comment></comment></comment></comment><comment><USER5> Kobe's mentality was always super inspiring to me. It definitely made me push myself further at points in my life in programming and various other activities. One quote that stood out to me from his jersey retirement was:

"Those times when you get up early and you work hard, those times when you stay up late and you work hard, those times when you don't feel like working, you're too tired, you don't want to push yourself, but you do it anyway. That is actually the dream. That's the dream. It's not the destination, it's the journey. And if you guys can understand that, then what you'll see happen is you won't accomplish your dreams, your dreams won't come true; something greater will."

Rest in peace.

</comment><comment><USER6> I'm not into celebrities nor am I a Laker fan —- really the opposite — but this has hit me more than I expected. One of the best comments I've seen is about how Kobe more or less achieved self actualization. He willed himself to be one of the greatest ever at his craft and was on his way to doing it again off the court while being what I can see from the outside as an amazing dad. It's sad to see someone with so much to give the world life's cut way short.

</comment><comment><USER7> He once said something along the lines of "if Shaq approached conditioning and practice the way he (Kobe) did they would have won at least ten titles in a row."

I can't help but wonder what might have been if Shaq followed Kobe's lead in this regard instead of becoming the player he did.

</comment><comment><USER8> I am finally glad to see a post that hasn't been taken down that recognizes Kobe Bryant, even though somewhat distantly.

The behavior I saw from mods and the HN community yesterday left a lot to be desired.

It left me questioning what qualifies as HN material and whether sometimes this group is sometimes stubborn just for the sake of it.

Kobe Bryant might not have been a technologist but he definitely played a huge role in a lot of developers' livelihood. Whether that was inspiration, motivation, drive or mental health... Kobe influenced a lot of people. It would be very arrogant to assume the HN community was free of his influence.

Every single Kobe post, no exception, was flagged or killed.

Some of us were not doing ok yesterday, and if we can't share our struggles with the rest of the community then why are we even here? I felt a lot of dictatorial tendencies yesterday on this platform and I personally really hated it.

Your heroes are different from mine. To pretend as if Kobe's death is of zero worth to this community is not only arrogant and selfish, but quite reflective of the pains minorities suffer in communities like these.

Today I showed up at work wearing my Mamba jersey in memoriam. Had I gone with the picture presented by HN yesterday, I would have thought I would have been all alone and would have had to explain my depression to a lot of other folks at work. Instead I was met with shared remorse and others also affected by the death. Most of the people at work were in similar mode and we shared our feelings and thoughts and comforted each other.

Yesterday, even if only for one day, I would have hoped HN would have been that support group.

Mamba mentality is real and has driven a number of us. May it live forever.

Rest in eternal peace Kobe!

<comment><USER9> And now the HN mods have flagged this comment as off-topic, which causes it to be collapsed by default for all viewers of this thread. Everyone needs to specifically click the [+X] on it to even be able to read it.

Regardless of that, it seems like you're upset because of some mistaken expectations of what HN is for. It's not trying to be a "general purpose" site where you should expect to be able to discuss any and all topics. It has a pretty narrow focus, and users tend to aggressively flag posts about anything without a clear connection to the set of subjects that they feel "belong" here.

You shouldn't try to treat HN as a place where you'll be able to find general news about the world or discuss anything in particular, no matter how important you feel it is. It's a good site for its particular niche, but you're going to end up with a myopic view if you aren't also using other sites too.

<comment><USER10> The fact that grumpy cat died got 153 upvotes [https://news.ycombinator.com/item?id=19938054](https://news.ycombinator.com/item?id=19938054)

And Niki Lauda who is a Formula One racer [https://news.ycombinator.com/item?id=19968174](https://news.ycombinator.com/item?id=19968174)

Point is there is no hard and fast rule and is subjective. There's plenty of people who died that have nothing to do with technology that have been not been flagged for removal.</comment></comment></comment>


Git-reset: three simple rules that capture most of its (complicated) behaviour - <AUTHOR> http://blog.plover.com/prog/git-reset.html

<comment><USER2> Nice! I also had a tough time understanding the manual on this topic, so I made the following diagrams: <http://cmurphycode.github.com/Git-Diagrams/> (Source is on GH, so you can send changes!)

I printed out the get/reset diagram and referred to it a lot when I learned git. I still check it every once in a while, for reassurance :)

<comment><AUTHOR> Excellent! Yes it seems a bunch of people like to visualise how the repo changes via these sorts of diagrams. <http://marklodato.github.com/visual-git- guide/index-en.html> has similar stuff.

<comment><USER2> Hey, those are great! I don't know how I haven't come across those- feels like I've explored every git resource on Google. Maybe I should've used DDG :)

</comment></comment></comment><comment><USER3> <voice type="robot"> i am dumb. still do not understand </voice></comment>


Ask HN: Which programming language and framework should I learn? - <AUTHOR>

I'm going to build a web application to get my programming skills up to date with the latest technologies used by startups in the US.
I'm a full-stack software engineer with some years experience building various web applications.
Which programming language, tools and framework should I learn that will be useful in the next couple of years? <comment><USER2> If you're interested in leaving your mark on web development, focus on becoming very proficient in JavaScript. Then take a look at any one of the currently popular JS frameworks/toolkits: Backbone, Angular, Batman, Knockout, etc.

<comment><USER3> What are your thoughts on Meteor? I'm still learning JS and frameworks, but it looks pretty interesting.

</comment></comment><comment><USER4> I prefer Django so my next statement may be slightly biased. I have a friend who likes Rails. I understand why, he's a mouth breather. I would still suggest Django even though my friend, who was dropped several times on the head by his parents, would recommend Rails. This debate is still at large, but in the end it comes down to preference. Python I might compare to, I'm bad with metaphors but something that is perfect and organized. Rails is similar to a group of sorority girls, drunk, on karaoke night at the bar. Tempting but I would probably leave

</comment><comment><USER5> Language: Python

Frameworks: Django, Flask (in that order for employability)

Language: Ruby

Frameworks: Rails, Sinatra

<comment><USER2> If you're going to take a look at Sinatra, I'd highly recommend Padrino - it's pretty much Sinatra+.

</comment></comment><comment><USER6> Rails (Ruby) or Django (Python).

</comment><comment><AUTHOR> Thanks for the replies! Ruby on Rails and Backbone it is, then!

<comment><USER2> Take a look at the CodeSchool courses if that's the path you're taking. Their Backbone course is an excellent introduction.

</comment></comment><comment><USER7> Ruby and Rails is currently in high demand right now. But so is Python.

</comment><comment><USER8> Rails</comment>


An AR demo works right inside the browser without any plugins - <AUTHOR> https://webxr-sneakers.lusion.co/ <comment><USER2> From the About page[0]

> Today, Android Chrome v81 supports WebXR by default. Hopefully other > browsers will follow soon so that AR can be used everywhere without any > plug-ins

[0] [https://webxr-sneakers.lusion.co/](https://webxr-sneakers.lusion.co/)

</comment><comment><USER3> Not supported in Safari mobile</comment>