78

I've received an email indicating that I've won a prize in the #SOreadytohelp t-shirt competion that contains a link to a Google Docs form. Having been around the block a few times, the email and form both smell a bit phishy to me:

  • The email is not specific about how the prize was won (it's actually completely non-specific).
  • The email does not address me by name, or even by screen name.
  • Neither the email nor the form contain links to Stack Overflow or Stack Exchange.
  • Neither the email nor the form feature any logo or other Stack Overflow or Stack Exchange trademarks.
  • The form is asking me to enter information that I would not expect to have to enter if the email were genuine.

I understand that the email address in my profile is not supposed to be publicly available, but Stack Overflow wouldn't be the first site in web history that wasn't completely secure. As much as I'd like to claim the prize, I'm reluctant to enter my phone number and Stack Overflow profile link into some unknown Google document without further confirmation regarding its validity, since doing so could provide confirmation of my email address, notification of my phone number and cross-reference information from my Stack Overflow profile to an unknown and untrusted third party.

Is there some way to validate whether the email and URL are genuine?

(If they are genuine, the team at Stack Overflow could do a better job of understanding some of the security issues that some of their users do battle with on a regular basis; I would have expected some kind of on-site notification, banner on my Stack Overflow profile page, or similar had they been genuine.)

13
  • 1
    As from this post: meta.stackoverflow.com/q/306399/3933332 It doesn't seems like you have to enter the phone number in a google form.
    – Rizier123
    Sep 21, 2015 at 15:24
  • 3
    Was the email from a stackexchange.com address? All of the other points your raise are kind of irrelevant. Anyone who knows about the SOReadyToHelp contest could easily phish you with your screen name and a link to SO. Sep 21, 2015 at 15:25
  • 55
    Hi person! Congratulations, you have won that competition you took part in the other day. Please send us your credit card data (for validation reasons) and your package will be on its way. Thanks!
    – Pekka
    Sep 21, 2015 at 15:26
  • 2
    Use PGP. That is a joke.
    – user456814
    Sep 21, 2015 at 15:26
  • @Rizier123 That's the post that made me wonder whether mine was genuine. It's a different competition / form (please excuse the UNIX slash); the one I got says the shipper requires it. Sep 21, 2015 at 15:47
  • 9
    @BilltheLizard It wouldn't be the first spoofed email I've seen with a genuine looking From: header. Sep 21, 2015 at 15:52
  • 2
    @Cupcake Is PGP awesome? Yes. Would PGP have solved this problem? Most definitely. Is PGP practical in today's day and age? Not at all, especially from a corporation that teaches about these things to begin with. Sep 22, 2015 at 1:33
  • 2
    @Qix note that I did mention that I was making a joke :(.
    – user456814
    Sep 22, 2015 at 2:20
  • 1
    That is a joke figured you were referring to the fact SO didn't use PGP. xD Sep 22, 2015 at 2:27
  • 10
    @Qix it is a joke with many layers. Like marble cake.
    – user456814
    Sep 22, 2015 at 6:21
  • 1
    You are justifiably suspicious. I saw the mail earlier and it does raise red flags.
    – Jan Doggen
    Sep 22, 2015 at 13:00
  • 1
    In general, looking at the envelope ("show original" in gmail, for instance) and reading the "Received:" headers is a very good clue. They're newest-first, so reading down the list and checking domain names you can find where your email provider got the email, and by reading up the list and checking domain names you can find where the email originally came from.
    – jthill
    Sep 22, 2015 at 13:13
  • @Cupcake We talking jumbo, medium, small, or byte-sized? Sep 22, 2015 at 13:19

2 Answers 2

79

I sent the email. (Congrats on winning, by the way!) You can see that I've got a diamond here on MSO, and an @stackoverflow.com email on my profile, the same one from which I sent the email. Additionally, as ryanyuyu noted, I posted a list of the winners here on meta, so anyone not trusting (or not receiving) my email had a way to know that they won and could reach out to me directly.

Unfortunately, employees don't have a way of sending on-site messages to users (short of misusing the mod message functionality) or adding the banners like you've suggested. Email is pretty much our only method of contacting users directly if it needs to be done in private.

But if you ever get an email from someone who seems to be a Stack employee, and you find it suspicious and you aren't sure if it's legit, feel free to challenge it by:

  • Submitting an inquiry through the /contact form (as you did in this case). Include the email address the message came from. The team who answers those requests will confirm that an employee with that email address sent you an email on purpose.
  • Asking the employee to confirm identity directly. Just send a new email to the address you found fishy, asking them to confirm that they just sent you an email or for any other details you need.

Vigilance is good, especially when the topic of the email is "you won a tihng! give me personal informations!!1". I'm sorry that we don't have a more sophisticated way of getting in touch with users. We operate in public by default, so we contact people privately infrequently enough that it doesn't make sense to build something specific for this purpose. Email works fine 99% of the time, and we're happy to take a few extra steps to confirm our identities whenever necessary.

15
  • 26
    You could use some standard mail template or at least some styling and logo. That would make the message more professional and will give users a saver feeling. Sep 21, 2015 at 18:21
  • 20
    @PatrickHofman That's certainly something we'll keep in mind for future emails of this type (as the #SOreadytohelp event has ended). Though little prevents a dedicated phisher from creating their own such styling, I can see how it might add a little bit of confidence.
    – hairboat
    Sep 21, 2015 at 18:37
  • One low-tech method would be to post the email subject line as an answer to a Meta.SO question "Which emails are genuine?", and link that answer in the email itself. It does require somewhat sane and specific subject lines as it's essentially open to a replay attack.
    – MSalters
    Sep 22, 2015 at 11:10
  • 19
    I saw the list and visited a few of the winners' profiles and then sent those people an e-mail. Some of them fell for it as they thought I was you. In all seriousness, this needs to be addressed. Sep 22, 2015 at 13:23
  • 4
    This should be the accepted answer, especially since it is coming from a mod and the email sender!
    – onebree
    Sep 22, 2015 at 13:24
  • 1
    There is e.g. LimeSurvey which could potentially be used to implement something like Google Forms. It could be hosted on a subdomain of SE. As long as you don't invite thousands of users, it should run fine. Sep 22, 2015 at 15:52
  • 6
    Abby, in the future it would be best to use a combination of e-mail and website. Since e-mail can be spoofed very easily, but a website is publicly viewable, the combination is needed. For example, link the google form from a blog post on the official site, and to discourage non-winners from filling out the form, one of the questions asks for a secret code which is sent in the email. Naturally the email should link to the blog post, with a short enough address that the recipient can retype it and know there's no URL funny business in the link.
    – Ben Voigt
    Sep 22, 2015 at 15:53
  • 2
    New delivery method, Abby shows up like Ed McMahon. Except how to get our address safely to her? I suggest a Google Docs form.
    – corsiKa
    Sep 24, 2015 at 2:01
  • 1
    Point 2 (ask them directly) should be submitted to ISSE. It's a classic Bob and Alice problem. If I ask the sender, then I've confirmed their existing data, even if they don't have enough to convince me. Never trust the sender. Always use a trusted 3rd party or trusted process (like /contact form) Sep 24, 2015 at 7:03
  • 1
    "the same one from which I sent the email" doesn't offer any kind of assurance; From addresses are essentially meaningless.
    – AakashM
    Sep 24, 2015 at 7:58
  • PGP signatures are good too. I know no one actually uses PGP, but it's quite a good for ID verification.
    – Sobrique
    Sep 24, 2015 at 9:39
  • 1
    Point 1 is a red herring; every knows that the "From" field can be trivially faked. I can send an email from [email protected] right now. Sep 24, 2015 at 10:16
  • 1
    @abbyhairboat : You should really securely sign you e‑mails in order to avoid phishing. In my country, this is a legal requirement for those kinds of e‑mails. Sep 24, 2015 at 12:39
  • 1
    I had the same problem with my 100k swag - and got satisfied by a personalized answer after I mailed to the official address given on the website. I'd have been less suspicious if the personal information form was hosted directly on stackoverflow.com, not some random google docs thingy. Maybe you could proxy it at least?
    – Bergi
    Sep 24, 2015 at 13:02
  • @tudor: Unless your mail-out is compromised, you can ask the SO employee safely to confirm his/her identity. Just make sure not only press reply to "sender", but confirm that it's an @stackoverflow.com address.
    – Bergi
    Sep 24, 2015 at 13:06
28

I'm not sure how to verify the email in general, but you can check this post for the winners of the #SOreadytohelp contest. Based on the query for the week 4 winners that Abby (a moderator and SE employee) provided, it looks like you are a winner of this contest. You'll have to decide for yourself if you trust that email, but I personally believe it's from SE.

3
  • 6
    I used the contact link on the SO help page and received a similar answer from the Stack Overflow Team by email. (When did I get so paranoid? Does it come with the job?) Sep 21, 2015 at 15:44
  • @MikeofSST I know what you mean. At least in the case of SE, I trust them pretty well (they do have all of SO and Security at their disposal). Also, I might just be less paranoid since I figure my cell number is already floating around there somewhere. It's not like my SSN or anything.
    – ryanyuyu
    Sep 21, 2015 at 17:56
  • 2
    @ryanyuyu That is why you need to sign up for a VoIP service: you can pick your phone number, and your SSN and your phone number can be the same number! Sep 22, 2015 at 13:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .