We are surrounded by practices that are bad, but when are criticized, people shrug off as "but everyone does them". No, they are still bad, no matter how many people do them, no matter how normal they are.
HR departments phish their own employees with emails like "go to this website and enter your corporate credentials to take the required SOX/HIPPA/diversity training". You'll never stop phishing until you stop phishing.
There's a constant stream of cybersecurity stories from the press based upon an anonymous government official. Every guide on journalism ethics criticizes the practice, and they are almost always a government official hiding behind anonymity promoting their agenda.
Such stories happen because government officials know they have the power. What the government says is "news" that deserves to be reported even if it's distorted or lies. It's just a matter of finding the most corrupt/friendly journalist who will spin it best to "break" this news
Promising some sort of whitepaper or other content that requires an email address is a trick used to harvest email addresses. It's always a trick. If it weren't, then you'd be willing to provide the same content for free without an email address.
Sure, many people like getting news and and even product information in their inboxes, so ASKING for an email address isn't subversive. It's the REQUIRING of an email address that's bad.
It's always bad. It's bad when it's some big evil corporation doing it. It's bad when it's our friends doing it. It's bad even when we ourselves do it. As an executive I've harangued my own HR department to stop phishing and my own marketing/sales people to stop spamming.
Bad/cleartext password storage is wrong, but it's the industry norm.
Pasting SQL queries with data is wrong, but it's the industry norm.
Non-SSL websites used to be the norm, a marker of a website you shouldn't trust, but somehow we've begun changing that norm.
Pasting SQL queries with data is wrong, but it's the industry norm.
Non-SSL websites used to be the norm, a marker of a website you shouldn't trust, but somehow we've begun changing that norm.
How about when it's a document that almost no effort has been spent creating, and which doesn't contain the content that was promised if you surrendered your email address? Then is it a 'trick'?
