#maybe I'll just make another blog or something

[katatty]

Shifting Priorities

Thank you for all the nice comments yesterday! Some really helpful perspectives that gave me a lot of ideas on how I can tackle my simmer's block :)

Mostly, I think I need to trim down the number of neighbourhoods I consider "active" and the amount of projects I am doing in general. I have a hard time letting go of neighbourhoods, especially if I am still somewhat invested in them! But I also need to face the fact that I only have so much free time, and do not want playing the sims to be the sole thing I do with that free time XD

For some neighbourhoods I will also be trying out a more stripped-down approach to blogging, similar to what I've been doing with Driftwood. It makes me a little sad because I like my sims to feel fleshed out as characters and giving them voices is a big part of that! But maybe I can save the prose/dialogue for times when it is particularly needed, rather than including it as a default.

Finally, I am going to prioritise based on what I actually have the most fun with, rather than letting popularity drive my decisions!! Some neighbourhoods I feel sad about potentially retiring because I know people enjoy them, or I feel bad admitting I am never going to finish projects people were excited for, but I have to remember simming is something I do for myself, not for popularity or for other people.

So, plans for my neighbourhoods:

Pleasantview Plus - will continue in its current form for the most part, but holdholds I found less inspiring will just get short summaries rather than extensive documentation. This hood is waaaaaaay too big and I think not that many people follow it all that closely, but it's also my one true love and I would like to start prioritising it again rather than it always being on the backburner

Uberhood Challenge (YouTube Series) - This is a short-term series, and will continue as planned until I finish the challenge, which I'm over halfway through :)

Hollyhead - I hate to say it because I know a lot of people love it, but I feel like I have sorta outgrown this neighbourhood? Some simmers like their settings to be an escape from the real world, and when I made Hollyhead I think it was what I needed too, but these days I find how upbeat & wholesome it is a bit, idk, constraining?? I crave drama and conflict in my stories!! I also have kinda lost interest in the BACC rules and have started to find it more book-keeping and hassle for what I get out of it... Whenever I do open the neighbourhood I still really enjoy actually playing it, and I love the characters so much, but I just haven't found the events interesting enough to want to write about. I think this neighbourhood will not be retired completely (yet), but I will move towards writing much shorter updates in the form of newspaper articles and see if that helps. If by the end of this season I still feel ehhh about it, I might formally end it <3

Driftwood - no complaints about this hood, I'll probably continue with the current style of documenting major events & new builds only

Spruceburg (YouTube series) - I would like to do another season of this next year, after I finish the uberhood challenge! But I will probably go for a schedule of like, one season of series per year, rather than posting consistantly. I enjoy YouTube a lot, but its a lot of work too and I think has majorly taken away from my blogging time this year, which I am mourning now lol!!

The Fiero Legacy - it is probably time to throw in the towel with this and admit I just don't enjoy playing legacy style or with story progression that much! I always enjoy the period where the heir is dating but once they settle down and have kids it becomes a chore and a grind, plus with story progression's time system I always feel rushed and like I can't take a sim out of the house for an outing without potentially missing important milestones - the urban setting feels so wasted when its all family gameplay, haha. Hallie should be at the club!! It was an interesting experiment and a nice change of pace, but idk if I really see myself returning to it. I love the sims themselves and the setting, but whenever I actually load up the neighbourhood I just feel kinda stressed and overwhelmed :(

As for my building projects like Belladonna Cove, perhaps at some point I will get really inspired and return to them but for now they are on indefinite break. I remember saying a few time in the past that I didn't really feel much need to make over Pleasantview and Strangetown because if I wanted nice makoevers I would use frottanas, and tbh I feel the same way about Belladonna Cove - if I was playing it I would just use plumbtales makeovers XD With my past neighbourhood makeovers I was really inspired to make them because there wasn't anything out there that was exactly what I wanted but, well, there's loooooads of nice Belladonna cove makeovers these days so I just don't feel much drive to make my own version I guess?? I think I also have lost interest in building a little becasue I am no longer into super heavily decorated lots - I prefer lighter lots that won't cause lag lol! So yeah, I am probably not retiring from building forever but its no longer a priority for me :)

[wh3atley-personality-core]

Hello, it's me, good old Wheatley! I tought that maybe I should speak to other people, it gets pretty lonely up here after all, and what better place to do it than the always safe and reliable internet! Surprisingly there's connection up here, so if you have any asks or rockets to send PLEASE do :-) //Wheatley RP ask blog run by a Weatley fictionkin! Main blog: @shr00mie-rat

//Notes, Rules and Text keys below

//Notes: -First let me get something clear; I'M NOT BRITISH, I know nothing of british culture and such, so I'll take advantage of the fact that Wheatley rarely uses British slang and that he was practically raised by Americans (even though I'm not American either) to use American terminology -along with the previous note, english is not my first language so apologize if I write something incorrectly -if your ask takes too much time to answer or just doesn't get answered it's because I'm busy with something irl, even though I'm starting this blog while I have some free time, i fear of getting busy some time soon, so my apologies in advance -along with the previous note, I might also take time to answer due to lack of motivation, ideas for responses, I simply didn't felt like responding it for any reason or merely just forgot about it -most of the responses will include a drawing either because it fits or because I feel like it -Most of this blog will be core and post game Wheatley and try to stay as canon as I can, but any other moment of the timeline (pre-post portal 1/pre portal 2) are ok -along with the previous note, there'll be some head cannons scattered here and there but they won't affect much of the canon -I haven't roleplayed in a really long time //Rules: -No NSFW, please, just don't, keep in mind that the mun is a minor -Keep ships at minimum, as much as I love shipping, I don't think the canon universe could fit many of them -OC friendly, as long as it makes sense in universe -if you're asking/rp as another character please make clear who you are unless your acc gives it away -if anything I do is not of your liking, either in a mun or muse response, don't send hate or report the blog, just block -basic rp rules like: No godmodding, no powerplay, no metagaming, no retconning -Sometimes (but I hope never) my emotions might win over me and will probably proyect my feelings over my muse //Text key: //OOC Narration "Speech" (Thoughts) 'Writing' //If you have any doubts, you can always DM me on my main blog :D

[transgenderprototype]

Sorry if it sounds like I was having a tantrum. I'm just frustrated at how the last time one of my blogs got shadowbanned, I got a response in a few hours and it was fixed in three days, but this time, all I get are the same goddamn emails telling me to "send a link to the post your reporting" when i didn't even report a post.

And it's been almost a week, multiple emails with the exact same response every. single. fucking. time.

[stillresolved]

.

[front-facing-pokemon]

[autistic-beanmonster2]

well i'm about to have an interesting day

[wolpatinga]

[obeymeow]

being neurodivergent is all fun and games until you remember those hourly quote bots on twitter and think well maybe I can't make a bot anymore but I could schedule a few quotes a day, that shouldn't be hard. it sounds fun to have a bunch of quotes of my favorite character Thirteen from hit mobile game Obey Me! and its sequel Obey Me! Nightbringer. and then you think about how arduous collecting the quotes is going to be but she's only been in the games for maybe a year and a half with little screentime and you love collecting things so you start but then you remember that you love collecting things so naturally you have ALL of her screentime in the game and suddenly you have 45k characters of quotes and are several lessons into season 4 (which is truly a trial in and of itself) but not nearly close enough to the end but you refuse to just stop collecting the quotes and make the account with the EXCESS of what you have already because you literally only have season 4 to get through and if you don't do it just seeing the bot (because now you've been informed you can make tumblr bots instead) will haunt you with that knowledge even if nobody else would ever know. this is a general anecdote of a situation that could easily happen to anyone though and not in any way related to my life

[mirrorofliterature]

I hate the equation of 'someone who engages in hp fandom' = raging bigot.

but given the terrible rate of adult literacy globally, am I really surprised? I mean media literacy, btw, critical thinking skills and this thing called nuanced and the damning rise of purity culture.

like. in all honesty. it is very frustrating to have all you are dismissed because you like to write hp content on occasion by thousands of people

[medicinemane]

To be honest, seeing a post about how since binders are hand wash and that's a pain, old washboards do a good job (did I reblog that?...I forget) really kind of makes me want to get a washboard for my laundry

See... I kind of fucking hate using machines like that for some reason. Like, I don't use the dishwasher, it's so much easier for me to do it by hand (even easier if I get ahold of some good dish rags cause... when I've got a rag I can get things cleaned even quicker and easier)

Just something about the loading and unloading... doesn't work well for me

But using a washboard on the couple things I use (I mean I'm at home a lot, so I don't go through a ton of stuff), and then hanging them on one of those little... like the indoor hanging racks (which I could make if I'd just make it)... that feels easier too me

Hard to get started doing cause... it's... it's a big learning investment, not that it's complex but like... even if you... well even if I know all the steps for something, doing it the first time still is really hard and like learning, I can't say how it is for you

But like, once I started doing it and was used to it I feel like I'd do it a lot more than I'm willing to do laundry in a machine

...I don't know... just thoughts I have. Don't know why I'm like this, but I am

[ventcode]

i want attention from everyone. because in some way somehow, i still feel empty.

[vampirememer]

Hmm

I agree that Sherlock belongs elsewhere, but not that Homestuck is the third of the Supernatural/Doctor Who triumvirate.

I think the completion of the superwho- trinity is the Marvel Cinematic Universe. It's a long running behemoth with cultural weight that featured Monster of the Week-type beginnings and evolved into convoluted narratives. It had male leads that 15 year olds on tumblr in 2013 wanted to fuck. It wasn't a TV show (right away), but I think it fits better than almost anything else. Loki, Castiel, & The Doctor walk into a bar together and the universe warps around them into Tumblr University.

And Sherlock. Sherlock had queer baiting, sure. It's not overly long, but I think what drew people to it (aside from going nuts over Bunkerdink Cumblepitch) was that it made them feel smart. It made them feel special and a little bit deranged. I think Sherlock should be grouped with Hannibal.

Now homestuck? Homestuck is a sprawling sci-fi behemoth lasting longer than is plausible and deliberately veering into ridiculousness, featuring a Heroes Breeze Into Town monster of the week format and universe-level stakes and a WHOLE lot of speculative “what if what if what if.” But it is also a coming of age story. It over-reacted to fan interactions. It is written by a self-absorbed nut-job who inserted a lot of real world bigotry. It drove people insane every time it updated. It floundered the ending horribly despite actually having solid narrative build-up. It featured a sorting system that some people took way too seriously. There may or may not be children named after characters in that thing. There are more similarities but I think you know where I'm going. Homestuck belongs in a category with Harry Potter.

unrelatedly people are always like “lmao what was supernatural doing in superwholock” and i’ve said that myself in the past but actually no. what was SHERLOCK doing in superwholock. like i know the answer is queerbait but also like. supernatural and doctor who as sprawling sci fi behemoths lasting longer than is plausible deliberately veering into ridiculousness featuring a Heroes Breeze Into Town monster of the week format and universe-level stakes and a WHOLE lot of speculative “what if what if what if” . sandbox shows cultural curiosities. sherlock is NOTHING she’s DUST. britishness does not a similarity make

[burningcomputerpersona]

was getting a twelve pack of beer a bad idea? probably. am i enjoying it though? absolutely.

[lokilysolbitch]

should i impulsively start working on my new blog theme instead of sleeping

[front-facing-pokemon]

[mostlysignssomeportents]

How I got scammed

If you'd like an essay-formatted version of this post to read or share, here's a link to it on pluralistic.net, my surveillance-free, ad-free, tracker-free blog:

https://pluralistic.net/2024/02/05/cyber-dunning-kruger/#swiss-cheese-security

I wuz robbed.

More specifically, I was tricked by a phone-phisher pretending to be from my bank, and he convinced me to hand over my credit-card number, then did $8,000+ worth of fraud with it before I figured out what happened. And then he tried to do it again, a week later!

Here's what happened. Over the Christmas holiday, I traveled to New Orleans. The day we landed, I hit a Chase ATM in the French Quarter for some cash, but the machine declined the transaction. Later in the day, we passed a little credit-union's ATM and I used that one instead (I bank with a one-branch credit union and generally there's no fee to use another CU's ATM).

A couple days later, I got a call from my credit union. It was a weekend, during the holiday, and the guy who called was obviously working for my little CU's after-hours fraud contractor. I'd dealt with these folks before – they service a ton of little credit unions, and generally the call quality isn't great and the staff will often make mistakes like mispronouncing my credit union's name.

That's what happened here – the guy was on a terrible VOIP line and I had to ask him to readjust his mic before I could even understand him. He mispronounced my bank's name and then asked if I'd attempted to spend $1,000 at an Apple Store in NYC that day. No, I said, and groaned inwardly. What a pain in the ass. Obviously, I'd had my ATM card skimmed – either at the Chase ATM (maybe that was why the transaction failed), or at the other credit union's ATM (it had been a very cheap looking system).

I told the guy to block my card and we started going through the tedious business of running through recent transactions, verifying my identity, and so on. It dragged on and on. These were my last hours in New Orleans, and I'd left my family at home and gone out to see some of the pre-Mardi Gras krewe celebrations and get a muffalata, and I could tell that I was going to run out of time before I finished talking to this guy.

"Look," I said, "you've got all my details, you've frozen the card. I gotta go home and meet my family and head to the airport. I'll call you back on the after-hours number once I'm through security, all right?"

He was frustrated, but that was his problem. I hung up, got my sandwich, went to the airport, and we checked in. It was total chaos: an Alaska Air 737 Max had just lost its door-plug in mid-air and every Max in every airline's fleet had been grounded, so the check in was crammed with people trying to rebook. We got through to the gate and I sat down to call the CU's after-hours line. The person on the other end told me that she could only handle lost and stolen cards, not fraud, and given that I'd already frozen the card, I should just drop by the branch on Monday to get a new card.

We flew home, and later the next day, I logged into my account and made a list of all the fraudulent transactions and printed them out, and on Monday morning, I drove to the bank to deal with all the paperwork. The folks at the CU were even more pissed than I was. The fraud that run up to more than $8,000, and if Visa refused to take it out of the merchants where the card had been used, my little credit union would have to eat the loss.

I agreed and commiserated. I also pointed out that their outsource, after-hours fraud center bore some blame here: I'd canceled the card on Saturday but most of the fraud had taken place on Sunday. Something had gone wrong.

One cool thing about banking at a tiny credit-union is that you end up talking to people who have actual authority, responsibility and agency. It turned out the the woman who was processing my fraud paperwork was a VP, and she decided to look into it. A few minutes later she came back and told me that the fraud center had no record of having called me on Saturday.

"That was the fraudster," she said.

Oh, shit. I frantically rewound my conversation, trying to figure out if this could possibly be true. I hadn't given him anything apart from some very anodyne info, like what city I live in (which is in my Wikipedia entry), my date of birth (ditto), and the last four digits of my card.

Wait a sec.

He hadn't asked for the last four digits. He'd asked for the last seven digits. At the time, I'd found that very frustrating, but now – "The first nine digits are the same for every card you issue, right?" I asked the VP.

I'd given him my entire card number.

Goddammit.

The thing is, I know a lot about fraud. I'm writing an entire series of novels about this kind of scam:

https://us.macmillan.com/books/9781250865878/thebezzle

And most summers, I go to Defcon, and I always go to the "social engineering" competitions where an audience listens as a hacker in a soundproof booth cold-calls merchants (with the owner's permission) and tries to con whoever answers the phone into giving up important information.

But I'd been conned.

Now look, I knew I could be conned. I'd been conned before, 13 years ago, by a Twitter worm that successfully phished out of my password via DM:

https://locusmag.com/2010/05/cory-doctorow-persistence-pays-parasites/

That scam had required a miracle of timing. It started the day before, when I'd reset my phone to factory defaults and reinstalled all my apps. That same day, I'd published two big online features that a lot of people were talking about. The next morning, we were late getting out of the house, so by the time my wife and I dropped the kid at daycare and went to the coffee shop, it had a long line. Rather than wait in line with me, my wife sat down to read a newspaper, and so I pulled out my phone and found a Twitter DM from a friend asking "is this you?" with a URL.

Assuming this was something to do with those articles I'd published the day before, I clicked the link and got prompted for my Twitter login again. This had been happening all day because I'd done that mobile reinstall the day before and all my stored passwords had been wiped. I entered it but the page timed out. By that time, the coffees were ready. We sat and chatted for a bit, then went our own ways.

I was on my way to the office when I checked my phone again. I had a whole string of DMs from other friends. Each one read "is this you?" and had a URL.

Oh, shit, I'd been phished.

If I hadn't reinstalled my mobile OS the day before. If I hadn't published a pair of big articles the day before. If we hadn't been late getting out the door. If we had been a little more late getting out the door (so that I'd have seen the multiple DMs, which would have tipped me off).

There's a name for this in security circles: "Swiss-cheese security." Imagine multiple slices of Swiss cheese all stacked up, the holes in one slice blocked by the slice below it. All the slices move around and every now and again, a hole opens up that goes all the way through the stack. Zap!

The fraudster who tricked me out of my credit card number had Swiss cheese security on his side. Yes, he spoofed my bank's caller ID, but that wouldn't have been enough to fool me if I hadn't been on vacation, having just used a pair of dodgy ATMs, in a hurry and distracted. If the 737 Max disaster hadn't happened that day and I'd had more time at the gate, I'd have called my bank back. If my bank didn't use a slightly crappy outsource/out-of-hours fraud center that I'd already had sub-par experiences with. If, if, if.

The next Friday night, at 5:30PM, the fraudster called me back, pretending to be the bank's after-hours center. He told me my card had been compromised again. But: I hadn't removed my card from my wallet since I'd had it replaced. Also, it was half an hour after the bank closed for the long weekend, a very fraud-friendly time. And when I told him I'd call him back and asked for the after-hours fraud number, he got very threatening and warned me that because I'd now been notified about the fraud that any losses the bank suffered after I hung up the phone without completing the fraud protocol would be billed to me. I hung up on him. He called me back immediately. I hung up on him again and put my phone into do-not-disturb.

The following Tuesday, I called my bank and spoke to their head of risk-management. I went through everything I'd figured out about the fraudsters, and she told me that credit unions across America were being hit by this scam, by fraudsters who somehow knew CU customers' phone numbers and names, and which CU they banked at. This was key: my phone number is a reasonably well-kept secret. You can get it by spending money with Equifax or another nonconsensual doxing giant, but you can't just google it or get it at any of the free services. The fact that the fraudsters knew where I banked, knew my name, and had my phone number had really caused me to let down my guard.

The risk management person and I talked about how the credit union could mitigate this attack: for example, by better-training the after-hours card-loss staff to be on the alert for calls from people who had been contacted about supposed card fraud. We also went through the confusing phone-menu that had funneled me to the wrong department when I called in, and worked through alternate wording for the menu system that would be clearer (this is the best part about banking with a small CU – you can talk directly to the responsible person and have a productive discussion!). I even convinced her to buy a ticket to next summer's Defcon to attend the social engineering competitions.

There's a leak somewhere in the CU systems' supply chain. Maybe it's Zelle, or the small number of corresponding banks that CUs rely on for SWIFT transaction forwarding. Maybe it's even those after-hours fraud/card-loss centers. But all across the USA, CU customers are getting calls with spoofed caller IDs from fraudsters who know their registered phone numbers and where they bank.

I've been mulling this over for most of a month now, and one thing has really been eating at me: the way that AI is going to make this kind of problem much worse.

Not because AI is going to commit fraud, though.

One of the truest things I know about AI is: "we're nowhere near a place where bots can steal your job, we're certainly at the point where your boss can be suckered into firing you and replacing you with a bot that fails at doing your job":

https://pluralistic.net/2024/01/15/passive-income-brainworms/#four-hour-work-week

I trusted this fraudster specifically because I knew that the outsource, out-of-hours contractors my bank uses have crummy headsets, don't know how to pronounce my bank's name, and have long-ass, tedious, and pointless standardized questionnaires they run through when taking fraud reports. All of this created cover for the fraudster, whose plausibility was enhanced by the rough edges in his pitch - they didn't raise red flags.

As this kind of fraud reporting and fraud contacting is increasingly outsourced to AI, bank customers will be conditioned to dealing with semi-automated systems that make stupid mistakes, force you to repeat yourself, ask you questions they should already know the answers to, and so on. In other words, AI will groom bank customers to be phishing victims.

This is a mistake the finance sector keeps making. 15 years ago, Ben Laurie excoriated the UK banks for their "Verified By Visa" system, which validated credit card transactions by taking users to a third party site and requiring them to re-enter parts of their password there:

https://web.archive.org/web/20090331094020/http://www.links.org/?p=591

This is exactly how a phishing attack works. As Laurie pointed out, this was the banks training their customers to be phished.

I came close to getting phished again today, as it happens. I got back from Berlin on Friday and my suitcase was damaged in transit. I've been dealing with the airline, which means I've really been dealing with their third-party, outsource luggage-damage service. They have a terrible website, their emails are incoherent, and they officiously demand the same information over and over again.

This morning, I got a scam email asking me for more information to complete my damaged luggage claim. It was a terrible email, from a noreply@ email address, and it was vague, officious, and dishearteningly bureaucratic. For just a moment, my finger hovered over the phishing link, and then I looked a little closer.

On any other day, it wouldn't have had a chance. Today – right after I had my luggage wrecked, while I'm still jetlagged, and after days of dealing with my airline's terrible outsource partner – it almost worked.

So much fraud is a Swiss-cheese attack, and while companies can't close all the holes, they can stop creating new ones.

Meanwhile, I'll continue to post about it whenever I get scammed. I find the inner workings of scams to be fascinating, and it's also important to remind people that everyone is vulnerable sometimes, and scammers are willing to try endless variations until an attack lands at just the right place, at just the right time, in just the right way. If you think you can't get scammed, that makes you especially vulnerable:

https://pluralistic.net/2023/02/24/passive-income/#swiss-cheese-security

Image: Cryteria (modified) https://commons.wikimedia.org/wiki/File:HAL9000.svg

CC BY 3.0 https://creativecommons.org/licenses/by/3.0/deed.en