Hacker News new | past | comments | ask | show | jobs | submit login

> They are e-mailing employees directly and asking them to contact Oracle

That would certainly look a lot like phishing




In this case, I think it's actual fishing...


So 90% of cold-call recruiting/sales is also "phishing"?


I'd say "yes". If a cold-call results in anything than blacklisting the company that called you, you're setting yourself up for failure.


Those are completely different.

One is "Hi my name is XYZ at company ABC. Do you want to talk about our product DEF?" to which you instantly know it's a sales call and how to respond.

The other is specifically emailing employees asking about their use in order to build a case against their employer in the hopes of getting an enterprise agreement or lawsuit out of it. It's far more shady and the actual nature of the communication is not revealed until after the fact. For all the developer knows, it's just a support email from Oracle asking them about how they use their product.


Whether the intent is positive or negative is unrelated to whether it's phishing. You could phish someone's info and then send them a gift basket.


Let me clear it up for you:

"Hello my name is X I would like to sell you Y" is not phishing. It's not asking for any information. It's annoying, sure, but you know how to deal with it and they won't bother continuing when they know you're not interested (ie. by saying no)

"Hello my name is X, I work at Oracle, do you have a few minutes to talk about your use of VirtualBox" followed by asking questions about how you use it in order to build a case against your employer can be perceived as phishing. They are either outright not representing or misrepresenting the purpose of the conversation, and asking for information for purposes other than what you'd expect. It doesn't fit the exact definition in the dictionary, but it's close enough and uses the same sort of tactics that it can easily be considered another example of it.


I don't think the purpose of the conversation matters. It's about if/how you fake your identity and what information/access you collect.

That's why I bring up phishing personal info to send a gift basket. Despite flipping the purpose on its head, it's still phishing.


The misrepresentation of the purpose is what brings it into phishing territory. By misrepresenting the purpose, you're also misrepresenting who you are and what your intentions are.

Something that's already phishing will still be phishing even if the purpose is misrepresented. Something that isn't otherwise phishing, however, can be made into something akin to phishing by misrepresenting the purpose.


> The misrepresentation of the purpose

Incorrect. It's not about purpose. It's about misrepresenting who you are. Oracle is saying they are Oracle. If Oracle is pretending to be someone else, than it's phishing.

What you are describing is not phishing. It's just regular old fishing.


> By misrepresenting the purpose, you're also misrepresenting who you are

Wha?


Maybe this got lost halfway down this comment thread, but the whole point of this being considered phishing-like is that Oracle was emailing individual developers, asking questions about their use. The developers didn't realize so that Oracle can build a case against their employer and accidentally gave away details that Oracle would then use to pressure the employer to get licenses or would outright sue.

Developers likely thought they were speaking to Support, or responding to some kind of survey/questionnaire about their use cases and how they use VirtualBox, when in reality were being misled as to the actual purpose of the conversation.

Just because they were speaking to someone from Oracle as opposed to a third party scammer does not mean that the person they were speaking with didn't misrepresent/fake who they were.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: