Hacker News Reader

Comment by chc | Hacker News Reader

It makes more sense than doing it over the telephone. I'm not sure how you expect them to send URLs. If you are sophisticated enough not to need a URL emailed to you, then you won't need it, but I don't see a practical alternative for other people.

View on HN

Tell me, what URL could a bank need to communicate to me in email that they couldn't replace with instructions like "login and click on ..."?

People will also follow re-key instructions taking them to phishing sites. They'll tell strangers their passwords and download and run unique video codecs (aka malware) to watch some special comedy video file they've been sent by a friend. The answer is to educate your friends, family and any stranger who will listen to perform some critical analysis on an unsolicited approach by e-mail, phone, sms, or whatever.

Well, the obvious if somewhat facetious answer here is "the URL to log in." Another, less facetious one is "a password reset link." But even if we accept that expecting customers to follow long lists of directions without error is remotely reasonable, it doesn't matter because scammers are certainly not going to be fastidious about avoiding links, so by avoiding them yourself, you are only making it more convenient for your customers to get scammed than to actually do business with you.

I can see the value in not blindly visiting URLs received via email. I do not see the value in refusing to send links via email. Unless you yourself are a scammer, making people do error-prone extra work to access your site does not protect anyone from getting scammed.

Reply on news.ycombinator.com