On Sunday, May 15, 2005, 8:07:30 PM, Computer wrote: CHS> Thanks for the info. That would explain why my questions were not replied CHS> too. Thought no one was checking. I will resume sending spam.
CHS> Can you explain what you meant by: "This is to prevent any kind of "social CHS> engineering" that might be attempted". Contrary to popular belief, most important security violation hacks are based on social engineering rather than technical means (spyware, breaking firewalls, worms, etc). Since it is very important that our services remain secure, we implement a number of protocols to prevent ourselves from being "tricked" by social engineering. A well known example of social engineering these days is the phishing spam --- the message appears to be from your bank, which you trust, and so when your "bank" asks you to refresh their memory about your information you are tricked into giving it to them --- that is, unless you are hep to the scam. Similar scams happen all the time in larger support organizations where a fake technician or user might call in to support, pretend to be "one of the guys" and ask for a quick password reminder or some other important technical tidbit. Often enough this stranger pretending to be a friend will walk away from the phone call with the password or technical detail they want -- then they can then gain access to the system at their leisure. Along these lines, if someone pretending to be one of our users asks us a question in a spamtrap then we will ignore that content - just in case it is some black-hat trying to trick us. Another aspect of this protocol is that it helps us avoid false positives -- if the text appears to be a legitimate technical question to anyone then by definition it is "not spam" so we will skip it (unless we notice a trend...) Similarly - our false positive process includes software and procedures that check the authentication of the sender to verify that they are really a customer before we respond with any potentially secure information. Hope this helps, _M This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
