5

The help center defines questions on phishing as on topic here and I personally would agree to that, if this follows the same logic as given by AviD here.

Quote from AviD:

If the question is based around either actual security measures, or business risk analysis...
AND if it's not about your grandmother getting scammed at home... AND if it's not about "help i got phished quick what do i do" AND if its more about "business" security.

I would therefore argue, that the FAQ in the help center should be revised to include the same logic as above and "Is this a phishing mail?" questions should be flagged as off topic from the get go.

Another approach could be the following:

I was looking for good duplicate targets for the duplicate question list and stumbled upon this question.

The answer lists a number of methods to identify phishing and scam mails which is basically the same methods we would apply if a user asks the question "Is this a phishing attempt?"

From now on every "Is this a phishing mail?" question could be marked as a duplicate of this question.

2
  • 3
    I agree that we probably shouldn't encourage questions that ask whether a particular email is malicious and instead maybe establish a canonical post on how to identify phishing emails in general. The post you linked applies pretty specifically to phone calls though, doesn't it?
    – Arminius
    Commented Mar 9, 2018 at 22:22
  • @Arminius Oops.. linked to the wrong question. Edited the correct one in now.
    – Tom K.
    Commented Mar 9, 2018 at 22:30

2 Answers 2

Reset to default
6

The problem is if there was an algorithm that could be reliably employed and could be captured in an Answer, then we would not have a phishing problem as email servers could use the algorithm to prevent the emails. I've looked into this a lot over the years. There is no clear technical answer on how to determine if an email is a phish or not.

The answers in the question you link to are mostly about how to interpret the content with some technical analysis on the side. What if an infosec pro wants to know how to interpret some specifics in the header? I think that could be on topic.

If you limit the set of questions to: "I got this weird email, is it a phish?" then, yes, that question is a great duplicate.

But, just like all email analysis, I am not sure that there can be a clear single approach. I wish there was.

3
  • Well, do you think there's a way to amend the FAQ? Right now it just says "including phishing". Maybe something like: "technical analysis of phishing and spam mails" or emphasizing that this SE is not for fixing user's malware and phishing issues? (Just throwing this out there.)
    – Tom K.
    Commented Mar 12, 2018 at 8:28
  • 4
    @TomK. In general, I think it is better to close "simple" questions as duplicates of some canonical question than to try to draw complex boundaries between on and off topic.
    – Anders
    Commented Mar 12, 2018 at 11:47
  • 3
    Compare it to how we deal with all "I got a virus" questions - we close them as duplicates. In my opinion that is more helpful to the asker, and is also simpler for the community.
    – Anders
    Commented Mar 12, 2018 at 11:49
1

I believe marking it as a duplicate is the best way to go.

  • The original poster gets enough information to make his own decision.
  • Subsequent viewers are directed to useful information.
  • Potential responders will not waste time reinventing the wheel.

In this case, we are fortunate to have a very well-written response. It would be a shame to let it go to waste.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .