安全与隐私troyhunt.com
谢谢 FedEx，这就是我们总被钓鱼的原因
Thanks FedEx, this is why we keep getting phished
2024 — 2026，它一次次回到首页
黑点是上首页（≥ 50 分）的那次投稿，空心点是没冲上去的投稿，点越大分数越高。
导读
Troy Hunt 结合 FedEx 的实例，说明很多合法机构的官方通知在发件域名、附件形式、可验证渠道等方面与钓鱼邮件几乎无法区分，用户既无从辨别真假，也被迫养成轻信或麻木的习惯。文中还提到 FedEx 海关清关邮件来自个人邮箱、附件处理草率等具体问题。
为什么经久不衰：它点出了钓鱼泛滥的结构性原因——合法机构自己就在训练人们怀疑或盲从，这个矛盾十几年都不会过时。
HN 评论精选
FedEx 官方平台本身存在严重身份验证和可用性缺陷，比钓鱼更危险。
FedEx 可能是大公司里最差、最不安全的数字平台。举例：1）我搬进一栋 10 户公寓楼想设置 FedEx Delivery Manager，只填了新地址、毫无验证，就立刻看到了前租户的配送说明，其中包括大楼私人车库密码，任何小偷都能这么做。2）搬走时想加新地址却一直报错，论坛揭示的原因是：密码里含特殊字符会让站点某些部分永久损坏，包括改密码流程，只好让妻子用更差的密码注册新账号。对一家其他方面很出色的公司来说，这水平真是业余。
habosa查看英文原文
FedEx may have the worst and least secure digital platform for a major company. Some examples I’ve noticed: 1. I moved into a 10-unit apartment building and wanted to set up FedEx Delivery Manager. I just put in my new address, no verification whatsoever, and I was immediately given access to the previous tenant’s delivery instructions which included the buildings private garage code. Any thief could have done the same. 2. When I moved out of that building I wanted to add my new address to delivery manager … but I couldn’t. The site errored every time. The reason? Some forums revealed the correct hypothesis that if you have special characters in your password then some parts of the site are permanently broken for you. Including the change password flow. So I had to have my wife make a new account with a worse password. Truly amateur stuff for an otherwise very impressive company.
合法机构的不合理流程让谨慎的用户反而吃亏，验证身份的责任被推给了用户。
不久前我妻子申请了房屋净值贷款。有人打电话自称来自她申请的银行，要确认我同意贷款因为房子是我们共有的。他先问了我的姓名，我给了；又问 SSN 后四位，我也给了。接着他要完整 SSN，我警觉起来，说不会给，并问银行官网上有没有号码可以回拨核实他的身份。他显得很不耐烦，说官网上没有能联系到他的号码，如果我不给完整 SSN 就只能拒绝贷款申请。我说不愿向突然来电的陌生人提供这些信息，如果没有官方回拨渠道就到此为止，他愤怒地挂了电话。结果他还真是银行的，贷款申请也确实被取消了。
Rudism查看英文原文
A while ago my wife applied for a home equity loan. At some point I got a call from someone claiming to be from the bank she had applied through (I forget which one), calling to make sure I approved the loan since the home is in both our names. He asked for my name, which I gave him, and then the last four digits of my social security number, which I also gave him. He then proceeded to ask for my full social security number, at which point alarms started going off in my head and I started sweating about even giving the last four digits to a stranger who had called me out of the blue. I told him I wouldn't do that, and was there a number on the bank's website I could call in order to get back to him, in order to verify that he actually worked for the bank. The guy started acting really annoyed, and said he didn't think there was any number on the bank's website that could reach him, and that if I didn't give him my full social security number he would be forced to reject the loan application. I told him I didn't feel comfortable giving that information to someone who had phoned me, and if there was no way for me to call him back through an official bank phone number then the call was over. He hung up angrily. Turns out he actually was from the bank and he did cancel the loan application.
公司内部 IT 通知的形式比钓鱼还像钓鱼，却要求员工相信它是真的。
几个月前我收到公司 IT 中心的邮件，比任何钓鱼邮件都可疑：来自和公司官方域名毫不相像的通用域名（@itservice.com 之类）；主题是“紧急：你的账户即将过期”；正文里多个链接又长又难读，没有一个域名我能立刻联系到公司；除了点链接没有任何其他解决方式（没有“去账户设置”“联系你的主管”之类）。然而它居然是真的。公司约 10 万员工。
sebtron查看英文原文
A few months ago I got an email from the IT center of the company I work for that was dodgier than any phishing email I have ever received: - Coming from a domain that looks nothing like the official domain of the company, rather some generic @itservice.com or something. - Subject: "URGENT: your account is expiring soon". - Multiple links provided in the email body, all illegible and multiple lines long, none of them from a domain that I can immediately link to the company. - No alternative way of resolving the issue is provided other than clicking on one of those links (no "go to your account settings", "contact your line manager" or so). And still, it turns out it was real. ~100k employees company btw
FedEx 的官方清关邮件包含他人数据且脱敏方式草率，进一步加剧了不可信感。
看到这个觉得真巧。两年前我收到 FedEx 的海关通知，要我填写信息。那只是一封来自 FedEx 某个人的普通邮件，带一个 PDF 附件，而我并没有在等包裹。我找他们的聊天机器人（当然没有人工），经过一阵“提示工程”或者说威逼利诱，它终于转给人工，确认这不是诈骗、确实是他们的消息。我打开 PDF，里面预填的是别人的数据，用可移动的矩形遮挡，挪开就能看到下面的内容。那个包裹后来是海外合作者的惊喜礼物。多年后我看到 FedEx 标志仍有余悸。
lemursage查看英文原文
This is so weird, seeing this. Two years ago, I got a customs notice from FedEx asking to fill in my details. That was just a plain email from __some guy__ at FedEx with a PDF file attached. I wasn't expecting any package. I wrote to their chatbot (of course, no human assistance) and after some time of "prompt engineering," or what one might call coercing, it finally directed me to a human consultant who confirmed it was indeed not a scam, and that it was indeed their messaging. I opened the PDF, and it was pre-filled with someone else's data, with blank rectangles placed over fields in a bad attempt at redacting them (you could just move those rectangles around to reveal the underlying data). The package later turned out to be a surprise from collaborators abroad. Years later, I still feel that scam aftertaste whenever I see the FedEx logo.
历次讨论
同类还值得读
非法素数
Illegal prime
维基百科条目，介绍“非法素数”：某些素数之所以被称为“非法”，是因为它们经特定编码后，恰好对应一段被法律禁止传播的数据——最著名的是 DVD 解密程序 DeCSS 的代码，有人把…
安全与隐私上首页 5 次 · 2010–2021en.wikipedia.org编辑精选关于 /dev/urandom 的常见误区
Myths about /dev/urandom
（Thomas Hühn 撰写，2014 年首发并持续更新）逐条反驳关于 /dev/urandom 的常见误解：它与 /dev/random 使用的是同一个 CSPRNG，一旦完…
安全与隐私上首页 5 次 · 2014–20202uo.de编辑精选AES 高级加密标准火柴人图解
A Stick Figure Guide to the Advanced Encryption Standard (AES)
一篇用火柴人漫画形式讲解 AES（高级加密标准）算法的经典科普文章。
安全与隐私上首页 5 次 · 2009–2022moserware.com编辑精选指纹是用户名，不是密码
Fingerprints are Usernames, not Passwords
作者（eCryptfs 维护者、Ubuntu 安全工程师）认为指纹等生物特征是公开、不可更改的标识，应视作用户名而非密码，不能当作秘密凭据用于认证。
安全与隐私上首页 4 次 · 2013–2017blog.dustinkirkland.comHTTPS 连接的最初几毫秒（2009）
The First Few Milliseconds of an HTTPS Connection (2009)
逐毫秒拆解一次 HTTPS 连接建立时发生了什么，重点讲 TLS 握手、证书验证、RSA 签名与密钥协商等机制，面向不熟悉该领域的读者。
安全与隐私上首页 4 次 · 2009–2020moserware.com编辑精选