7

This email looks a little Phishy. The link takes me to a google docs form. How can I verify that this email is genuine?

It would be hard for me to verify much by the link, it's insecurly redirected through the same .email domain, starting with http://sg-links.stackoverflow.email/wf/click?...

enter image description here

13
  • 3
    Swat != swag...also I can think of some people who would be interested in being able to offer swat through email...
    – Servy
    Feb 9, 2018 at 19:25
  • 1
    stackoverflow.email Lol. Showoffs. Looks fairly legitimate though
    – Pekka
    Feb 9, 2018 at 19:26
  • 4
    Although that's really a super cool phishing idea: send congratulatory E-Mails to people who just hit 20k, 50k, 100k... and link to a Google or Stack Overflow login form.
    – Pekka
    Feb 9, 2018 at 19:26
  • 3
    Heavily related, meta.stackoverflow.com/questions/321681/…, but 2 years old (however, there are a few answers from about a year ago indicating the swag was still being sent @ 100K) Feb 9, 2018 at 19:26
  • 1
    @Pekka웃 It does require knowing their email, although not everyone has it private.
    – Servy
    Feb 9, 2018 at 19:27
  • Related, though I'm not really seeing any tips that help you confirm this is your 100k bonus email, since it's from do not reply instead of an employee... meta.stackoverflow.com/questions/306548/…
    – Kendra
    Feb 9, 2018 at 19:51
  • 1
    As a note, the CMs do use Google forms to collect swag information from users. The whois for the domain looks fine, though godaddy.com/whois/results.aspx?domain=stackoverflow.email All of the info points to it being SE-owned
    – Catija StaffMod
    Feb 9, 2018 at 19:51
  • 1
  • It's not really quite a duplicate. That question doesn't have anything to do with swag.
    – Catija StaffMod
    Feb 9, 2018 at 20:15
  • 1
    @Catija: But the email is coming from stackoverflow.email, which is emphasized in the OP. The unspoken question then is, "is this email legit", which is answered in the dupe.
    – Makoto
    Feb 9, 2018 at 20:16
  • 100k rep and this is your first meta post haha! Anyway, congrats on your milestone - well done!
    – DavidG
    Feb 10, 2018 at 1:06
  • The only thing I found suspicious was the 4300+ emails in your inbox. Feb 10, 2018 at 11:49
  • Worst "I hit 100k!" post ever! Seriously though, congrats, that's some achievement. Feb 10, 2018 at 20:41

1 Answer 1

12

First: Congratulations on reaching 100k!

The system sends an automated email when people reach that milestone and we are sending automated emails via stackoverflow.email now. Your screenshot it looks like the email we send. I don't have access to the email logs at the moment, but I think you can safely try the link.

Other than the sketchy .email domain, is there anything we can change to make the offer less suspicious?

7
  • Maybe put in a secure link in the email, and better clarify that it was sent automatically, first? If possible, use an EV certificate for the form.
    – gparyani
    Feb 9, 2018 at 20:28
  • 2
    Email itself, and links within emails, are basically impossible to authenticate. There's basically nothing you can put in the email that is convincing. If the form I had to fill out was obviously controlled by stackoverflow, (instead of google docs), I wouldn't have had this question. If the form were hosted on stackoverflow, or if you could reach the correct form by following a link on the site, I wouldn't have any concerns. Feb 9, 2018 at 20:38
  • 12
    An inbox notification saying, "Congrats on reaching 100K! We'll be reaching out to you soon for something awesome," would probably make this less sketchy. Well, it'd at least pacify...
    – Makoto
    Feb 9, 2018 at 20:38
  • 5
    @SingleNegationElimination We've wanted to switch to hosting the forms ourselves quite a few times since I've worked here. We hate using Google Forms with a passion but... it's what we're stuck with for now. Last time it was brought up, there was another plan in place that would make having a form obsolete altogether, but I'm not sure that plan is in place anymore. I'll bring it up again. I'd much rather have an inbox notification as Makoto suggests, and have it go directly to an on-site form, cutting out the email completely.
    – animuson StaffMod
    Feb 10, 2018 at 0:42
  • Seconding what @Makoto says because "you're killing it!" is also highly likely to be misunderstood outside the Anglo world...
    – Pekka
    Feb 20, 2018 at 15:01
  • @SingleNegationElimination ever heard of cryptographic signatures? You send an e-mail with some well-known text encrypted with your private key, then publish your private key on your official website. Anyone who receives that message can then verify its authenticity by using your public key to decrypt that text. If the message is as expected, then you can be sure the sender was legitimate, because only he could encrypt it with his private key to match the public one. There's no way to forge that (as long as the encryption is strong enough).
    – SasQ
    Jan 6, 2019 at 1:50
  • @SasQ indeed, but it's not up to me to publish a publickey fingerprint if stackexchange wants to send me an email, they'd need to do so. Also, i did get my swag :^) Jan 17, 2019 at 18:52

Not the answer you're looking for? Browse other questions tagged .