Yes.

Some more color. I use Intuit's assisted payroll service, which is fantastic. You run payroll straight out of QuickBooks and Intuit handles all the tax disbursement and filing for you.

I got an email today with an attachment called securedoc.html claiming to be a message from Intuit. The idea is that you open the attachment and then login to view the message.

It really couldn't look any more like a phishing email, however I called Intuit and remarkably it's a real message. They seriously expect me to open an email attachment and provide account information. The support person at Intuit was able to read the message to me and it was just a routine acknowledgment that some tax rates had been updated.

Intuit is seriously training its customers to fall victim to phishing attacks. The right approach would be to say that a message is available and to log in to your account to retrieve it, or better still to send a message through the existing system in QuickBooks. Securedoc.htm is just begging customers to provide their account information to the bad guys.

Intuit's payroll service stores bank account information, employee Social Security numbers and other data that you really don't want to expose. If you're an Intuit Payroll customer please call and complain. If you've received one of these messages I'd also recommend forwarding it to [email protected], their address for reporting phishing attacks. 

Add your comment...

Related Posts

• Is it safe to open securedoc.html (Cisco Registered Envelope)?
• Better Paperless
• Licensing Fail: WinZip vs. ScanToPDF
• Shiti
• Immature Gmail Exploit

(All Etc Posts)

(Published to the Fediverse as: Is Intuit Insane? #etc #spoof #phishing #intuit #quickbooks Intuit is training its customers to fall victim to phishing attacks by sending messages using securedoc.html )

Does Facebook now hate MMS? For the past couple of weeks every time I tried to send a photo I got the following error message:

You have uploaded from an unrecognized address. For instructions on how to upload photos to Facebook, go to http://www.facebook.com/mobile"

I got this sending to both [email protected] and 32665. The referenced page is no help at all, and my phone number is registered with Facebook Mobile.

It turns out that there's a new secret email address. On the Facebook site click the icon to share a photo:

Then click Upload a Photo:

Then click upload via email:

Your personal email address is finally revealed and can be used to send a photo via MMS.

Facebook - update your error message to point this out!

Add your comment...

Related Posts

• I can't post a single photo
• Immature Gmail Exploit
• The end of Facebook
• Fight Facebook with Email
• Email marketing - don't shoot yourself in the foot

(All Etc Posts)

(Published to the Fediverse as: MMS Photo Upload to Facebook #etc #facebook #mms How to MMS photo Upload to Facebook via the hidden personal upload email address. )

This is a joke metric that I first proudly displayed on Catfood Magazine back in 1997 (it's broken on the archive of the site). Everyone had a hit counter back then, but as far as I know we were the first site with a non-hit counter.

The dirty secret was that the counter just showed the world population. The readership was a rounding error.

My new count of non-visitors uses the US Census Bureau's world population estimate and subtracts unique visitors from the Google Analytics API. The count is cached for an hour so it doesn't slow the page down too much.

Updated 2022-11-15 14:50:

The United Nations says:

"The world’s population is projected to reach 8 billion on 15 November 2022..."

And the 8 billion number is being widely reported today, however my current unread count is a paltry 7,932,915,881. That's because the US Census world population estimate is a lot lower, by over 66.8M people. That's approximately France!

Add your comment...

Related Posts

• New Scientist on Immigration
• 1,000th Post!
• Coronavirus Visualization Update
• Not to be anal but (any number of dogs...)
• Can I move to a Better Simulation Please?

(All Etc Posts)

(Published to the Fediverse as: How many people don't read this blog? #etc #ithcwy As of the last update to this post, 7,927,037,899 people have not read I Thought He Came With You in the past month. )

Them: Hello, my name is Phil, how can I help you today?

You: My DSL connection is slow.

Them: Okay, I can help you with that, have you...

You: My first thought was that the Linksys router that's been working perfectly for five years has gone wrong. So I connected my computer directly to your off-brand modem with the same result. I then thought that the problem must be with the computer, so I reinstalled it from the manufacturer discs and rebooted about seven times.

Them: Let me connect you to my supervisor...

Them: Tap, tap, tap, oh, we seem to have switched your service back to the basic package. Tap, tap, tap, fixed.

Add your comment...

Related Posts

• Fixing dropped wireless connection for Linksys E4200
• Chromecast won't connect to wifi - finally found the fix
• Going Chrome
• Overvalidation
• Please fix phone spam Google!

(All Etc Posts)

(Published to the Fediverse as: How to get technical support without spending hours on the phone #etc #support How to bypass the first few levels of tech support and talk to someone who can actually help you. )

Overvalidation is unhelpful error checking, usually caused by an over-zealous engineer with insufficient domain knowledge. My blood pressure has suffered from two cases of overvalidation this week.

I bought a new NAS — the Linksys NAS200 to set up RAID 1 with a couple of 1TB drives.

I was delighted to discover that the NAS could send email when it detects a problem or starts running out of disk space. Except it couldn't because someone decided that an email server could live at port 25, or at port 1024 or higher.

My ISP blocks port 25 - maybe to cut back on bot spam, maybe because their support staff are bored and lonely. This is far from unique and it's common for email providers to offer an alternative port. Which is almost always port 587. I tried to put a bug report into Linksys but their support pages effectively said "dude, you paid $89 for this box, go talk to other losers on some forum".

The NAS problem can be solved by redirecting a port on my router. I haven't figured out how to deal with Technorati yet. After spending seemingly months moving their datacenter they've evidently done some work on their blog claim process. I created a new blog yesterday (Webcam Updates, to remove some clutter from the main Catfood Blog) and went over to Technorati to claim it.

When you enter a URL like "http://www.site.com/blog" it's automatically changed to "http://site.com/blog". Which is a different URL. I 301 redirect any "catfood.net" url to "www.catfood.net" to prevent getting dinged by Google for duplicate content. Technorati's claim process fails if there's a 301 redirect.

I guess I could remove the redirect, complete the claim and then hope that I can put the redirect back without breaking Technorati. Possibly when my blood pressure is back to normal.

Please, by all means do some validation – "giraffe" is most certainly not a valid TCP/IP port – but don't overvalidate, and don't assume that your mail server port or preferred URL convention is some kind of universal constant.

Add your comment...

Related Posts

• Securing the Internet of Things
• Air Gap
• How to get technical support without spending hours on the phone
• The curious case of the missing slugs (in BlogEngine.net 2.8)
• Email marketing - don't shoot yourself in the foot

(All Etc Posts)

(Published to the Fediverse as: Overvalidation #etc #cisco Overvalidation: when an engineer doesn't know what they don't know. )