CuttlePhish
Security and privacy
phishing simulation
SHOW HN2015
155points
69comments
#130of 2,565 in 2015
Top 6%of 2015 by points
How HN took it
CuriousMostly questions and neutral comments
7 positive, 20 neutral or asking, 1 mixed, 8 critical, out of 36 comments about the project. Thread score -0.02.
Idea: 3 for, 3 againstPrivacy: 1 for, 2 againstExecution: 0 for, 2 againstDocs: 1 for, 1 againstDesign: 2 for, 0 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
What people liked
Useful service and refreshing idea
From 3 comments
This is a useful service. But I imagine there will be some nontrivial issues regarding spam filtering, server reputation, legal, etc. How do you do email authentication? What are…
fokz on HNThat's a refreshing idea for a change. Well done!
talles on HN+1! This thing is awesome. And that would make it even more awesome.
andresmanz on HN
Good FAQ and branding
From 2 comments
the FAQ page is 10/10 https://cuttlephish.com/faq
zensavona on HNLove the brand and name (reminds me of https://www.youtube.com/watch?v=GDwOi7HpHtQ).
mikeknoop on HN
Objections
Clicking a link does not show someone would fall for the phish; need login pages to measure real victims
From 3 comments
There are many sites like this and I love what they are doing for raising awareness. As one of the first people to ever fight phishing (I worked at eBay and PayPal fighting…
jedberg on HNI often intentionally click links to phishing sites, and sometimes enter in fake usernames and passwords. (I even wrote several bots to auto enter thousands of random usernames…
Buge on HNHm. I often click on obviously phishing links to see what's there. Would this tool classify me as a victim?
runn1ng on HN
Simulations only give pass/fail data and can anger employees
From 1 comment
I work in security at a large Fortune 500 company. I know at first it sounds like phishing your employees will give you good insight, but you realize quickly that the data you…
pspace on HN
Emails may land in spam and trust in discarding credentials is a concern
From 2 comments
How do you send your emails ? If your customer is using google domains, microsoft 365 or what else, and the employees do not fall in your phishing attempt and report your mail as…
hrbrtglm on HNThanks and thanks for the suggestion! One thought I'd had was longer/more in depth campaigns. It's good to know other people would be interested in that as well. One thing I was…
naftaliharris on HN
Requests
Add credential-capturing login pages and self-hosting option
From 3 comments
There are many sites like this and I love what they are doing for raising awareness. As one of the first people to ever fight phishing (I worked at eBay and PayPal fighting…
jedberg on HNOr provide a self-hosting option; JavaScript can be changed at any moment. Request A might look fine, but request B for the same file 5 minutes later could be malicious.
nitrogen on HNLove it! My recommendation would be to offer an option for allowing the target to be tricked through the whole process. (Even if credentials are discarded completely.) The idea…
x0ry on HN
Support for phishing via multiple channels beyond email
From 1 comment
I work in security at a large Fortune 500 company. I know at first it sounds like phishing your employees will give you good insight, but you realize quickly that the data you…
pspace on HN
Flexible budget-based pricing
From 1 comment
You could address that by creating a control on the price. "I want to run this campaign against 500 users. But my budget is $100." The service sends out e-mails up to the $100…
mfenniak on HN
Questions
Are trademark templates like Amazon legal to use
From 1 comment
Neat! I really like the easy pricing model. Quick question - are you concerned about trademarks (Amazon and such) being included as the phishing templates? Reason I ask is that…
jwcrux on HN
How are emails authenticated and spoofed past spam filters
From 2 comments
Neat! I really like the easy pricing model. Quick question - are you concerned about trademarks (Amazon and such) being included as the phishing templates? Reason I ask is that…
jwcrux on HNThis is a useful service. But I imagine there will be some nontrivial issues regarding spam filtering, server reputation, legal, etc. How do you do email authentication? What are…
fokz on HN
Alternatives named
KnowBe4
From 1 comment
Neat, but doesn't seem very IT/corporate, which would surely be the intended audience. My company uses these guys: http://www.knowbe4.com/
watmough on HN
Apozy
From 1 comment
I work in security at a large Fortune 500 company. I know at first it sounds like phishing your employees will give you good insight, but you realize quickly that the data you…
pspace on HN
Phish5
From 1 comment
Another service which does a similar thing that's been around some time, I used them but the spam filter ate all my fake mail, as it should :-) https://phish5.com/
gnyman on HN
GoPhish
From 1 comment
Neat! I really like the easy pricing model. Quick question - are you concerned about trademarks (Amazon and such) being included as the phishing templates? Reason I ask is that…
jwcrux on HN