Ichthyology: Phishing as a Science
Why Hacker News recommends it
HN people cite it to show even technical users fall for phishing and that hardware security keys are the real fix.
What it is
Karla Burnett presents real phishing campaigns run against a Bay Area tech company, including conversion rates and how existing protections were bypassed. She argues for evidence-based techniques to prevent credential phishing, not just mitigate it.
Recommended by 3 HN commenters across 3 different months, 2018 to 2025.
What Hacker News said
Recommends dmbaggett · 2019-05 · on “Should Failing Phish Tests Be a Fireable Offense?”
Phishing is frankly an embarrassment for the mainstream security community. The temptation is to "blame the stupid users" -- but the truth is that even a script kiddie can take a real email from a mainstream brand, "Save As HTML...", change one link, and resend... and snare even sophisticated victims. This BlackHat talk ( [this video] ) shows just how easy it is to phish even users who think they are too good to be fooled. At Inky ( [LINK] ) we're using a combination of computer vision, anomaly detection, and domain-specific hacks to identify zero-day phishing emails "from first principles" (as I like to say). And it works! But the pushback from the security establishment is impressive. I like to
Recommends procinct · 2021-06 · on “Can Apple change ads?”
Maybe if you’re referring to regular phishing sure, but spear phishing is specifically designed so it won’t go to your junk email and will look like something made for them personally, there won’t be any spelling mistakes, it will have been sent from a likely email source, it will most likely contain some personal information. The right phish at the right time could catch just about anyone out. There’s a great talk at Black Hat about how Stripe trains staff against these sorts of phishing campaigns and these are highly technical people and they still click the links. [this video]
Recommends x0x0 · 2025-09 · on “We all dodged a bullet”
I watched a presentation from Stripe internal eng that was given I forget where. An internal engineer there who did a bunch of security work phished like half of her own company (testing, obviously). Her conclusion, in a really well-done talk, was that it was impossible. No human measures will reduce it given her success at a very disciplined, highly security conscious place. The only thing that works is yubikeys which prevent this type of credential + 2fa theft phishing attack. edit: karla burnette / talk [this video]
Cites SpaethCo · 2018-07 · on “Google: Security Keys Neutralized Employee Phishing”
This is where it comes down to user behavior. One of the security engineers from Stripe gave a talk about this at Blackhat last year -- she had phishing campaigns that had users ignore that autofill didn't work and manually copied/pasted their password manager credentials into the phishing sites. [this video]