#tedious personal details

[becausegoodheroesdeservekidneys]

The thing with the Mari Lwyd, though, is that it's being... I don't know, 'appropriated' is the wrong word, but certainly turned into something it isn't.

Thing is, this is a folk tradition in the Welsh language, and that's the most important aspect of it. I feel partly responsible for this, because I accidentally became a bit of an expert on the topic of the Mari Lwyd in a post that escaped Tumblr containment, and I clearly didn't stress it strongly enough there (in my defence, I wrote that post for ten likes and some attention); but this is a Welsh language tradition, conducted in Welsh, using Welsh language poetic forms that are older than the entire English language, and also a very specific sung melody (with a very specific first verse; that's Cân y Fari). It is not actually a 'rap battle'. It's not a recited poem. It is not any old rhyme scheme however you want.

It is not in English.

Given the extensive and frankly ongoing attempts by England to wipe out Welsh, and its attendant cultural traditions, the Mari is being revived across Wales as an act of linguistic-cultural defiance. She's a symbol of Welsh language culture, specifically; an icon to remind that we are a distinct people, with our own culture and traditions, and in spite of everyone and everything, we're still here. Separating her from that by removing the Welsh is, to put it mildly, wildly disrespectful.

...but it IS what I'm increasingly seeing, both online and in real world Mari Lwyd festivals. She's gained enormous pop-culture popularity in recent years, which is fantastic; but she's also been reduced from the tradition to just an aesthetic now.

So many people are talking/drawing about her as though she's a cryptid or a mythological figure, rather than the folk practice of shoving a skull on a stick and pretending to be a naughty horse for cheese and drunken larks. And I get it! It's an intriguing visual! Some of the artwork is great! But this is not what she is. She's not a Krampus equivalent for your Dark Christmas aesthetic.

I see people writing their own version of the pwnco (though never called the pwnco; almost always called some variant on 'Mari Lwyd rap battle'), and as fun as these are, they are never even written in the meter and poetic rules of Cân y Fari, much less in Welsh, and they never conclude with the promise to behave before letting the Mari into the house. The pwnco is the central part to the tradition; this is the Welsh language part, the bit that's important and matters.

Mari Lwyd festivals are increasingly just English wassail festivals with a Mari or two present. The Swansea one last weekend didn't even include a Mari trying to break into a building (insert Shrek meme); there was no pwnco at all. Even in the Chepstow ones, they didn't do actual Cân y Fari; just a couple of recited verses. Instead, the Maris are just an aesthetic, a way to make it look a bit more Welsh, without having to commit to the unfashionable inconvenience of actually including Welsh.

And I don't really know what the answers are to these. I can tell you what I'd like - I'd like art to include the Welsh somewhere, maybe incorporating the first line of Cân y Fari like this one did, to keep it connected to the actual Welsh tradition (or other Welsh, if other phrases are preferred). I'd like people who want to write their version of the pwnco to respect the actual tradition of it by using Cân y Fari's meter and rhyme scheme, finishing with the promise to behave, and actually calling it the pwnco rather than a rap battle (and preferably in Welsh, though I do understand that's not always possible lol). I'd like to see the festivals actually observe the tradition, and include a link on the booking website to an audio clip of Cân y Fari and the words to the first verse, so attendees who want to can learn it ahead of time. I don't know how feasible any of that is, of course! But that's what I'd like to see.

I don't know. This is rambly. But it's something I've been thinking about - and increasingly nettled by - for a while. There's was something so affirming and wonderful at first about seeing the Mari's climb into international recognition, but it's very much turned to dismay by now, because she's important to my endangered culture and yet that's the part that everyone apparently wants to drop for being too awkward and ruining the aesthetic. It's very frustrating.

#wales! #closed for cleaning on mondays #mari lwyd #tedious personal details

[andeloquentprofanity]

This week between Christmas and New Year is always the fucking worst. Sleep is messed up, physical and mental health deteriorates at a stunning rate. Send help

#tedious personal details #I feel physically sick #and like I want to punch someone #then be held and taken care of

[brasskingfisher]

Steampunk festival fun

I returned home from the weekend at the asylum steampunk festival today (the biggest steampunk festival in the solar system) and thought I'd share some thoughts before I have to head back to work tomorrow.

Positives:

1. I had a really good time and enjoyed myself

2. I got to hang out with some friends and other cool people I haven't seen since before covid

3. I did my 1st ever cosplay

4. I got complimented multuple times on my ace pride flag painted nails and my ace hatband

5. I met another Ace person (they commented on my nails) and got to hold their hand (I know that sounds like a really feeble thing, but this is the first time I've done anything like that since accepting myself as ace and they're cute)

Negatives:

1. The whole event felt quieter than the ones before covid (probably because of the plauge and fuel costs and stuff)

2. I still struggled a lot with my spoons (I didn't feel like I was running out, but spent a lot of time feeling like I do when I am short of spoons)

3. I ended up spending too much money (not so much that I'm not going to be able to pay bills, but I am going to have to do a bit of financial juggling)

#weekend at the asylum 2022 #weekend at the asylum #uk steampunk #steampunk community #ace steampunk #lgbtqia #tedious personal details #steampunk

[librarianofdoom]

2023 is going to be amazing! How do I know this? Because I’m spending the new year with amazing friends at an amazing concert. What better new beginnings could you want?

#tedious personal details

[mermaidsirennikita]

Y'all are TRULY sleeping on Hyacinth by S.M. LaViolette. Like, I really enjoyed Phoebe (first book in the series), but Hyacinth is on another level. It features:

--a scarred libertine duke

--a neurodivergent heroine (23 to his 36) who happens to be KILLER at playing cards (in part because she's counting them) and sneaks out at night to play them while dressed as a very awkward young man

--a very casual interest in kink from her that makes him (a kinky man) go "O_O"

--a shockingly fabulous scene in which he tries to get her to admit she's a girl by taking her to a brothel, making her watch two people fuck while sitting beside him, and rattling off like 75 slang phrases for "jerking it" before being like "there's nothing WRONG with it bOY MEN MASTURBATE IN FRONT OF EACH OTHER ALLLL THE TIME" and starting to pull his dick out

--her: "AHHHH NO--YES? NO!"

--RIDING CROPS!

--so MUCH begging from this man, SO. MUCH. BEGGING.

--they're switches, your honor

--squirmy carriage BJs

#i think reading this close to phoebe has also given me some personal insight about my reading habits #and don't get me wrong i wholeheartedly approve of phoebe it's a 4.25/5 and it's so fun #but to get a book into what is feeling like unless something goes wrong in the homestretch 4.5-5 range #at least with historicals... i need a hook beyond a well-written virgin/marriage of convenience book #unless ofc it's truly exceptional (see: devil in winter) i want to see like... SOMETHING happening that gives it a distinct feeling #(i think is probs why that first elisa braden series while fun w some truly standout entriesgot tedious after a point for me #bc it was like... all virgin marriage of convenience books with different spins) #the detail and thought that went into how she wrote hyacinth and its plot is so good to me #romance novel blogging #anyway this is a delightful book would recommend

[fancifulplaguerat]

My Nina/Polyhedron thoughts have afflicted me with considering how Aglaya’s hellbent mission to destroy the Polyhedron informs her hatred of Nina and vice versa. I want to structure this around this dialogue between Clara and Daniil:

“Aglaya sees the Polyhedron as Nina Kaina's infernal gift. She thinks that Nina rose high, but her pride drew down the wrath of heavens. Aglaya believes that her duty is to destroy this challenge before it has lead to more evil. Or maybe she doesn't even believe that […] She desperately, hopelessly abhors her sister. Even stronger than her worst enemy. When I got to uncover this secret and looked into her soul, my hair stood on end! Aglaya believes her sister to be the devil himself, a deathbringer.” 

I feel it is a little pointless to establish how much Aglaya hates Nina because lol. lmao. Aglaya put her whole heart and soul and pussy too into hating Nina’s guts it is not difficult to parse. But I do want to point to two dialogues which reference this. An Herb Bride claims that “[Nina and Aglaya] hate one another. Or rather the inquisitor hates the Mistress. I think Nina probably disregarded her,” but Victor states that “[there was a] mutual grudge between the sisters that persisted despite the difference in age. It’s a terrible, hopeless feud that even the elder sister’s death has done nothing assuage.” I am inclined to follow Victor’s claim, given that he was undoubtedly closer to them.

As for *why* Aglaya and Nina were perpetually at odds, I think it is foremost because Aglaya considered Nina cruel for her disregard of human life. While Aglaya is rather sharp-tongued and harsh, she is highly motivated by a desire to help and protect others. Indeed she spells it out in some instances, saying, “I am a humanitarian. My duty is to save people, not kill them,” and “I only wish to do good; not specific, targeted good, like that Clara, but overarching good.” She likewise tells Clara, “Human lives are valuable to me. To this day, I’ve been paying for my kind-heartedness.” Which. I am routinely obsessed with that last sentence. In my opinion, it implies Aglaya is prone to sympathy or kindness, that she perhaps even resents this feature of herself. That in turn suggests to me that this kind-heartedness is a prominent feature of her personality, if it is something that (by her admission) routinely bites her in the ass. And I can see sympathy being an issue for her, being an Inquisitor. Despite her ruthlessness, Aglaya cares for others; thus her resentment for Nina seems rooted in her conviction that Nina is an opposing force for absolute evil and harm, just as Aglaya conceives of miracle and the Polyhedron.

Aglaya characterizes herself as a servant of the law, one who “restore[s] the mechanics of the Universe.” She defines the Law as balance and harmony—anything which ruptures that homeostasis has violated the Law, and this is what Aglaya deems “evil.” Aglaya repeats this viewpoint to all three healers, but I think a prominent example is when she tells Clara that “Miracles violate the world; they're abusive in nature. When the world was conceived, it was conceived as a coherent whole, without contradictions. Harmony is the main, indeed the only component of any Universe. However ugly a world may be, however unfair it may seem—it is nonetheless harmonious!” She likewise states that “When mysterious evil emerges from nonexistence, it’s a clear sign that [the Law] has been violated. Disease is a retribution for trespassers. It’s an attempt to restore the balance.” She further says: “In accordance with the Law, the very logic of our world inevitably dictates the destruction of anything unnatural: anything that tries to break its own, non-capitalized laws. The disease is nothing more than a tool. It is an instrument of inevitability.” This logic informs her motivations in-game, with several dialogues across routes telling the player that Aglaya seeks to destroy the Polyhedron rather than end the epidemic. This aligns with Aglaya’s conception of the universe, the Law, and justice; after all, Aglaya views the Sand Pest as an instrument of the Law, retribution for the Kains’ miracle—as she says, “The Law stipulates a harsh punishment for an attempt to capture a miracle.” Thus to Aglaya, it is the Polyhedron which presents the true evil, not the disease.

It further interests me that Clara claims that to Aglaya, “there are no such things as miracles; that’s just the way she was made.” That fundamentally Aglaya cannot conceive of the miraculous, unlike her sister, who was predisposed to it. This reinforces that to Aglaya, the Polyhedron cannot be a miracle, only a violation of the Law which thus spawned the plague as punishment. I think Aglaya could likewise consider the Polyhedron and Nina as one and the same, which they are, to an extent—even without my preferred interpretations, Nina is playing musical soul chairs in that thing when not haunting her husband bodily. And given that Aglaya is a self-described servant of the Law and Nina functionally Utopia, I feel that one could view the two sisters as representative of these respective entities perpetually at odds with one another. Yet even with Aglaya and Nina in contrasting roles, I still hold that there is much similarity between them, but. This post is plenty lengthy already, so I shall save that for a later date :,) I wanted to end, instead, with some speculation about Aglaya’s sense of revenge, in particular given that last sentence of Clara’s dialogue—“Or maybe she doesn’t even believe that.”

Returning to that conversation with Victor, I am struck by his response when Artemy asks who could have motivated Aglaya’s potential schemery in Town. That is: “Not a ‘who.’ A ‘what.’ Despair.” This, in my mind, echoes Aglaya’s dialogue when she discusses Block. She claims that, “For a moment, I thought he was driven by the same feeling that I am: a great man, when unexpectedly betrayed by the people he loves, will often seek to fill the whole universe with his blind spite. Yes, the feeling is indeed familiar…” And that line goddamn haunts me. There seems a suggestion, if minimal, that Aglaya’s anger may be influenced by a sense of wounding or betrayal? Not solely her own death or trying to drag Nina down on her way to the grave (it makes me unwell that Clara says Aglaya wants to destroy the Polyhedron “As her final word.” Insanity. Btw.) I suppose Aglaya’s despair or betrayal could broadly refer to some capital confidants of hers, but I do wonder if it references Nina somehow? If only from a narrative standpoint, given that Nina informs Aglaya’s revenge and thus main drive in the story. Once again, characters reiterate that Aglaya’s Inquisitorial duty in Town is a mere means to the end of destroying the Polyhedron; for instance, Daniil states Aglaya “tried to settle personal accounts with her deceased sister” rather than fulfill her duty.

I have no answer to this, I only wonder—does Aglaya somehow feel betrayed by Nina? Did Aglaya even have enough attachment to Nina to feel betrayal to begin with? Maybe one could interpret that, given Aglaya’s description of herself as motivated by blind spite incurred by an unexpected betrayal by people she loves. I don’t know. But I find that far more compelling than Aglaya hating Nina without question, in particular when considering their relationship through the lens of Aglaya as the Law and Nina as Utopia.

#sorry that I include so many quotes but #I use these as personal reference so I appreciate having all my favorite details in one place #I imagine it might make for tedious reading though #also I think I might actually be in love with aglaya. a little bit. #save me doomed wife. doomed wife save me........ #pathologic #patho.txt #nina kaina #aglaya lilich

[andeloquentprofanity]

School rant for a second. I started my summer 8-week course this week and I am STRESSED AF. I have been thinking about dropping because I didn't think I could do the work to my standards due to my poor mental state lately. I've been so stressed (and generally depressed) that I had to leave work early on Tuesday because I shut down and was basically a vegetable. I passed out for several hours then woke up and decided, still half out of my mind but semi-functional, to complete the first essay assignment. I couldn't tell you what I wrote. But I did it and turned it in. Got the grade today, 7 out of 5. I got bonus points. What the fuck? How did I do that?

Now, I'm questioning everything. Do I drop out for my sanity or stay in the course, and complete assignments when I am not of sound mind but still apparently passing as a functioning human being?

This is the reason people don't believe me when I say I am in a really bad mental state. I'm still functioning and fairly successful.

#tedious personal details #grad school #depression #stress #fucking hell just give me my degree #haven't I suffered enough

[brasskingfisher]

Ace steampunk

Decided on a whim a while ago to try making an ace hat band. It didn't work because I suck at sewing, but still decided to tie the ribbons around my hat(s) as a subtle nod to my asexuality whilst I've been wandering around the asylum this weekend to show how welcoming and accepting the steampunk community is

#steampunk #steampunk festival #weekend at the asylum 2022 #weekend at the asylum #ace pride #LGBTQIA #lgbt pride #ace steampunk #tedious personal details #crafts #fashion #steampunk community #uk steampunk

[myreia]

Why is it that whenever I have an unintentional nap it always makes me grumpy. Or amplifies any previous grumpiness by 1000%. And then I see something on my dash that is completely unrelated to the thing that I'm annoyed about and then that unrelated thing annoys me and the grumpiness is amplified by another 1000%...

#bapping myself away from the keyboard #go have a snack and some water and realign the stars in the universe #the underlying issue isn't folks complaining about one of my favourite classes in a video game yet again #the issue is that I got a review calling my writing “tedious and lengthy when the story goes too much in depth of details” #and i need to let it go since i really shouldn't see that stuff in the first place #you're entitled to your opinions reviewer thanks for the 2 stars emailed directly into my inbox! #the review and rating system on itch.io is abysmal #it makes no sense #reviews are supposed to be for players to communicate their impressions to other players #not a one-sided discussion with a direct line to the creator's inbox that no one else can see #unless they happen to be following the person who wrote the review and it showed up on their feed #creator hellsite what can you do #go get a snack anna you're grumpy #talktag

[good-night-space-kid]

Fyodor Dostoevsky writes books for people who are nosy and want to know everything about the drama of everybody they have ever met

#I find it a bit tedious personally #but idk if the man was a huge gossip irl but I think 75-85% if every book is details about the lives of the characters #these details barely affect the plot btw #why am I reading another of his books? idk. why not. when else will I have the time to listen to a 35 hour audiobook

[mostlysignssomeportents]

How I got scammed

If you'd like an essay-formatted version of this post to read or share, here's a link to it on pluralistic.net, my surveillance-free, ad-free, tracker-free blog:

https://pluralistic.net/2024/02/05/cyber-dunning-kruger/#swiss-cheese-security

I wuz robbed.

More specifically, I was tricked by a phone-phisher pretending to be from my bank, and he convinced me to hand over my credit-card number, then did $8,000+ worth of fraud with it before I figured out what happened. And then he tried to do it again, a week later!

Here's what happened. Over the Christmas holiday, I traveled to New Orleans. The day we landed, I hit a Chase ATM in the French Quarter for some cash, but the machine declined the transaction. Later in the day, we passed a little credit-union's ATM and I used that one instead (I bank with a one-branch credit union and generally there's no fee to use another CU's ATM).

A couple days later, I got a call from my credit union. It was a weekend, during the holiday, and the guy who called was obviously working for my little CU's after-hours fraud contractor. I'd dealt with these folks before – they service a ton of little credit unions, and generally the call quality isn't great and the staff will often make mistakes like mispronouncing my credit union's name.

That's what happened here – the guy was on a terrible VOIP line and I had to ask him to readjust his mic before I could even understand him. He mispronounced my bank's name and then asked if I'd attempted to spend $1,000 at an Apple Store in NYC that day. No, I said, and groaned inwardly. What a pain in the ass. Obviously, I'd had my ATM card skimmed – either at the Chase ATM (maybe that was why the transaction failed), or at the other credit union's ATM (it had been a very cheap looking system).

I told the guy to block my card and we started going through the tedious business of running through recent transactions, verifying my identity, and so on. It dragged on and on. These were my last hours in New Orleans, and I'd left my family at home and gone out to see some of the pre-Mardi Gras krewe celebrations and get a muffalata, and I could tell that I was going to run out of time before I finished talking to this guy.

"Look," I said, "you've got all my details, you've frozen the card. I gotta go home and meet my family and head to the airport. I'll call you back on the after-hours number once I'm through security, all right?"

He was frustrated, but that was his problem. I hung up, got my sandwich, went to the airport, and we checked in. It was total chaos: an Alaska Air 737 Max had just lost its door-plug in mid-air and every Max in every airline's fleet had been grounded, so the check in was crammed with people trying to rebook. We got through to the gate and I sat down to call the CU's after-hours line. The person on the other end told me that she could only handle lost and stolen cards, not fraud, and given that I'd already frozen the card, I should just drop by the branch on Monday to get a new card.

We flew home, and later the next day, I logged into my account and made a list of all the fraudulent transactions and printed them out, and on Monday morning, I drove to the bank to deal with all the paperwork. The folks at the CU were even more pissed than I was. The fraud that run up to more than $8,000, and if Visa refused to take it out of the merchants where the card had been used, my little credit union would have to eat the loss.

I agreed and commiserated. I also pointed out that their outsource, after-hours fraud center bore some blame here: I'd canceled the card on Saturday but most of the fraud had taken place on Sunday. Something had gone wrong.

One cool thing about banking at a tiny credit-union is that you end up talking to people who have actual authority, responsibility and agency. It turned out the the woman who was processing my fraud paperwork was a VP, and she decided to look into it. A few minutes later she came back and told me that the fraud center had no record of having called me on Saturday.

"That was the fraudster," she said.

Oh, shit. I frantically rewound my conversation, trying to figure out if this could possibly be true. I hadn't given him anything apart from some very anodyne info, like what city I live in (which is in my Wikipedia entry), my date of birth (ditto), and the last four digits of my card.

Wait a sec.

He hadn't asked for the last four digits. He'd asked for the last seven digits. At the time, I'd found that very frustrating, but now – "The first nine digits are the same for every card you issue, right?" I asked the VP.

I'd given him my entire card number.

Goddammit.

The thing is, I know a lot about fraud. I'm writing an entire series of novels about this kind of scam:

https://us.macmillan.com/books/9781250865878/thebezzle

And most summers, I go to Defcon, and I always go to the "social engineering" competitions where an audience listens as a hacker in a soundproof booth cold-calls merchants (with the owner's permission) and tries to con whoever answers the phone into giving up important information.

But I'd been conned.

Now look, I knew I could be conned. I'd been conned before, 13 years ago, by a Twitter worm that successfully phished out of my password via DM:

https://locusmag.com/2010/05/cory-doctorow-persistence-pays-parasites/

That scam had required a miracle of timing. It started the day before, when I'd reset my phone to factory defaults and reinstalled all my apps. That same day, I'd published two big online features that a lot of people were talking about. The next morning, we were late getting out of the house, so by the time my wife and I dropped the kid at daycare and went to the coffee shop, it had a long line. Rather than wait in line with me, my wife sat down to read a newspaper, and so I pulled out my phone and found a Twitter DM from a friend asking "is this you?" with a URL.

Assuming this was something to do with those articles I'd published the day before, I clicked the link and got prompted for my Twitter login again. This had been happening all day because I'd done that mobile reinstall the day before and all my stored passwords had been wiped. I entered it but the page timed out. By that time, the coffees were ready. We sat and chatted for a bit, then went our own ways.

I was on my way to the office when I checked my phone again. I had a whole string of DMs from other friends. Each one read "is this you?" and had a URL.

Oh, shit, I'd been phished.

If I hadn't reinstalled my mobile OS the day before. If I hadn't published a pair of big articles the day before. If we hadn't been late getting out the door. If we had been a little more late getting out the door (so that I'd have seen the multiple DMs, which would have tipped me off).

There's a name for this in security circles: "Swiss-cheese security." Imagine multiple slices of Swiss cheese all stacked up, the holes in one slice blocked by the slice below it. All the slices move around and every now and again, a hole opens up that goes all the way through the stack. Zap!

The fraudster who tricked me out of my credit card number had Swiss cheese security on his side. Yes, he spoofed my bank's caller ID, but that wouldn't have been enough to fool me if I hadn't been on vacation, having just used a pair of dodgy ATMs, in a hurry and distracted. If the 737 Max disaster hadn't happened that day and I'd had more time at the gate, I'd have called my bank back. If my bank didn't use a slightly crappy outsource/out-of-hours fraud center that I'd already had sub-par experiences with. If, if, if.

The next Friday night, at 5:30PM, the fraudster called me back, pretending to be the bank's after-hours center. He told me my card had been compromised again. But: I hadn't removed my card from my wallet since I'd had it replaced. Also, it was half an hour after the bank closed for the long weekend, a very fraud-friendly time. And when I told him I'd call him back and asked for the after-hours fraud number, he got very threatening and warned me that because I'd now been notified about the fraud that any losses the bank suffered after I hung up the phone without completing the fraud protocol would be billed to me. I hung up on him. He called me back immediately. I hung up on him again and put my phone into do-not-disturb.

The following Tuesday, I called my bank and spoke to their head of risk-management. I went through everything I'd figured out about the fraudsters, and she told me that credit unions across America were being hit by this scam, by fraudsters who somehow knew CU customers' phone numbers and names, and which CU they banked at. This was key: my phone number is a reasonably well-kept secret. You can get it by spending money with Equifax or another nonconsensual doxing giant, but you can't just google it or get it at any of the free services. The fact that the fraudsters knew where I banked, knew my name, and had my phone number had really caused me to let down my guard.

The risk management person and I talked about how the credit union could mitigate this attack: for example, by better-training the after-hours card-loss staff to be on the alert for calls from people who had been contacted about supposed card fraud. We also went through the confusing phone-menu that had funneled me to the wrong department when I called in, and worked through alternate wording for the menu system that would be clearer (this is the best part about banking with a small CU – you can talk directly to the responsible person and have a productive discussion!). I even convinced her to buy a ticket to next summer's Defcon to attend the social engineering competitions.

There's a leak somewhere in the CU systems' supply chain. Maybe it's Zelle, or the small number of corresponding banks that CUs rely on for SWIFT transaction forwarding. Maybe it's even those after-hours fraud/card-loss centers. But all across the USA, CU customers are getting calls with spoofed caller IDs from fraudsters who know their registered phone numbers and where they bank.

I've been mulling this over for most of a month now, and one thing has really been eating at me: the way that AI is going to make this kind of problem much worse.

Not because AI is going to commit fraud, though.

One of the truest things I know about AI is: "we're nowhere near a place where bots can steal your job, we're certainly at the point where your boss can be suckered into firing you and replacing you with a bot that fails at doing your job":

https://pluralistic.net/2024/01/15/passive-income-brainworms/#four-hour-work-week

I trusted this fraudster specifically because I knew that the outsource, out-of-hours contractors my bank uses have crummy headsets, don't know how to pronounce my bank's name, and have long-ass, tedious, and pointless standardized questionnaires they run through when taking fraud reports. All of this created cover for the fraudster, whose plausibility was enhanced by the rough edges in his pitch - they didn't raise red flags.

As this kind of fraud reporting and fraud contacting is increasingly outsourced to AI, bank customers will be conditioned to dealing with semi-automated systems that make stupid mistakes, force you to repeat yourself, ask you questions they should already know the answers to, and so on. In other words, AI will groom bank customers to be phishing victims.

This is a mistake the finance sector keeps making. 15 years ago, Ben Laurie excoriated the UK banks for their "Verified By Visa" system, which validated credit card transactions by taking users to a third party site and requiring them to re-enter parts of their password there:

https://web.archive.org/web/20090331094020/http://www.links.org/?p=591

This is exactly how a phishing attack works. As Laurie pointed out, this was the banks training their customers to be phished.

I came close to getting phished again today, as it happens. I got back from Berlin on Friday and my suitcase was damaged in transit. I've been dealing with the airline, which means I've really been dealing with their third-party, outsource luggage-damage service. They have a terrible website, their emails are incoherent, and they officiously demand the same information over and over again.

This morning, I got a scam email asking me for more information to complete my damaged luggage claim. It was a terrible email, from a noreply@ email address, and it was vague, officious, and dishearteningly bureaucratic. For just a moment, my finger hovered over the phishing link, and then I looked a little closer.

On any other day, it wouldn't have had a chance. Today – right after I had my luggage wrecked, while I'm still jetlagged, and after days of dealing with my airline's terrible outsource partner – it almost worked.

So much fraud is a Swiss-cheese attack, and while companies can't close all the holes, they can stop creating new ones.

Meanwhile, I'll continue to post about it whenever I get scammed. I find the inner workings of scams to be fascinating, and it's also important to remind people that everyone is vulnerable sometimes, and scammers are willing to try endless variations until an attack lands at just the right place, at just the right time, in just the right way. If you think you can't get scammed, that makes you especially vulnerable:

https://pluralistic.net/2023/02/24/passive-income/#swiss-cheese-security

Image: Cryteria (modified) https://commons.wikimedia.org/wiki/File:HAL9000.svg

CC BY 3.0 https://creativecommons.org/licenses/by/3.0/deed.en

#pluralistic #social engineering #phishing #ai #swiss cheese security #infosec #finance #fraud #carding