Standard phishing is generally thought of as a brute force attack in which the attacker crafts fake emails meant to fool the broadest set of people possible (e.g., you’re much more likely to see a phishing email claiming to be from a large national bank, like Chase or Bank of America, than a small regional bank). Whereas spear phishing has conventionally been viewed as a more bespoke approach that is targeted at a specific individual or organization. So the current conventional wisdom is that normal phishing attacks are relatively easy to spot, and only relatively sophisticated attackers going after high-value targets, like access to government or corporate systems, use spear phishing. But what if that’s changing?
Over the last several months, I have been the target of what might be a new, more scalable, approach to spear phishing. I have been receiving phishing emails that are sent using the names of people I know but not their email addresses (see below).
I was at first confused at how the attackers were coming up with these names. My first fear was that they had hacked my email account and thus had access to my address book, but I have 2-step verification enabled and I didn’t see any suspicious access in the Last account activity.
Then as I was looking through my spam folder this week, I noticed a pattern: the names being used were all people who had recently commented on my Facebook posts. This is just a hypothesis and there’s a lot I still don’t understand about the attack, like how they associated my email address with my Facebook profile, how they are scraping the comments on my Facebook posts, and most of all why they would target me.
But if in fact they are scraping Facebook activity to come up with the names to use as senders, this opens up a much more scalable (and thus dangerous) vector for spear phishing. I’m very curious to hear if anyone else has experienced similar attacks and/or has any other information to add.
]]>For me, the most interesting ideas were on 'constructing value' for a previously unknown product. First, you need to have a compelling free offering so there is minimal risk to customers trying your new product. Secondly, you should take the lead in setting the perceived value of your new product by using an 'anchor' of premium pricing even if you end up selling at a discount to it.
"We really enjoy the work that we’re doing and we don’t want to cheapen it. Consciously or unconsciously — probably both — we’re trying to create a manageable way to earn a living and still maintain our sanity. We value time as much, if not more so, than money."
"The basic pattern of openness is that better access to information and better systems lead to better decisions and better living. This general principal is broadly accepted, but we're just now discovering that it also applies to the minutiae of our lives."


I agree with a lot of Kareem's thinking on these matters (which is probably why we're friends
) and greatly admire (and somewhat envy) his courage to so aggressively pursue these questions. So, it's great to be able to ride along on his journey even from afar. My favorite line from this post is: "The opposite of quiet desperation, I reasoned, is magnificent fulfillment."
2009 is not 1949. Modern consumer electronics and the Internet have ushered in a new economy of plenty. Production costs have decreased at an astounding rate. Distribution has become ubiquitous. It is no longer necessary, for all but the most ambitious projects, to seek out a studio to bankroll your pilot and a network executive to green light you for a time slot. Your talent and work ethic are now greater predictors of your success than who you know."



I think you’re missing the point of the uproar over the DiggBar. It isn’t about SEO or search engine ‘juice’ or 3rd-party traffic stats or even about the structure of the web, it’s about control. Publishers like to know they at least have the option to be in control of how a visitor interacts with their site, and you have ignored that need.
Personally, I feel you’re perfectly within your rights as a driver of traffic to do whatever you want with your outbound links. And publishers, like John Gruber, are perfectly within their rights to do whatever they want to visitors from your pages. But, why do you guys have to fight about it? Do you hear any similar outcry over Facebook’s ‘action bar’, which arguably intercepts a lot more overall traffic than the DiggBar ever will? I haven’t, and I think it’s simply because from the start they have given publishers a simple way to opt-out.
From the Facebook Share Partners page (click ‘What is the blue bar that appears over my webpage? Is there a way to prevent it from appearing?’):
When someone clicks on your shared item, they are redirected to your page, and a small action bar is added above your site. The action bar promotes further sharing so that more people can see your content If you would like to disable this feature, simply add this code to your web page:
  <script type=”text/javascript”>
   if (top.location != location) {
    top.location.href = document.location.href;
   }
  </script>
Is anyone actually using this? Probably not. Would most publishers want to block the DiggBar? I highly doubt it. As TechCrunch implies, traffic is still king for most publishers:
If the Diggbar can [drive a 20% boost in traffic] consistently going forward, nobody is going to be complaining about it anymore—even if URL shorteners are still evil.
Those publishers who have different priorities, as is their right, *will* find ways to block the DiggBar, which in this case results in a crappy experience for visitors coming from your site. But if you were to officially support opt-out on a per site basis (a la Facebook), publishers could could control their sites as they wish without the end-user experience having to suffer for the sake of an argument most of them don’t understand or care about.
Love,
-jonathan
Disclosure: I run a publisher services company building a product that happens to shorten URLs. For the record, I don’t think URL shorteners are evil, just misunderstood 