安全与密码学2012research.microsoft.com
为什么“尼日利亚骗子”说他们来自尼日利亚
Why 'Nigerian Scammers' Say They're From Nigeria
进阶 · 约 35 分钟读完前置知识：基础概率论、信号筛选（signaling）、网络安全/欺诈背景
导读
这篇微软研究院的论文用经济学和信号筛选的角度解释：尼日利亚诈骗邮件为何常自称来自尼日利亚、内容又显得很拙劣。核心结论是，这种“明显不可信”的诱饵会劝退大多数人，只留下最容易上当的少数目标，从而降低后续筛选成本、提高诈骗效率。
HN 关注点：它用一个反直觉的筛选模型解释诈骗邮件为何写得离谱，并围绕模型假设、国籍标签和实际诈骗操作展开争论。
后来怎么样
它把诈骗邮件中的拙劣叙事解释为一种信号筛选机制，成为安全经济学和反欺诈讨论中的常见分析框架，并被后续研究用于理解网络诈骗的目标选择。
HN 评论精选
这几条评论里：支持 1 质疑 3
支持概括论文核心：拙劣诱饵用于自我筛选受害者。
我觉得归根结底就是这句话：“发送一封能排斥掉除最轻信者之外所有人的邮件，骗子就能让最有希望的目标自我选择，并把真阳性与假阳性的比例扭向有利于自己的方向。”
antimora查看英文原文
I suppose it boils down to this "By sending an email that repels all but the most gullible the scammer gets the most promising marks to self-select, and tilts the true to false positive ratio in his favor."
质疑质疑论文以定量模型给出单一原因，指出诈骗形式有限且国籍归属未经证实。
乍看之下，论文结论显得很聪明、也说得通，但我认为理解这类原因，定性研究比定量研究更准确。应指出，论文讨论的诈骗形式（模板/模型被称为 formats）属于遗产和腐败官员一类，并未涉及彩票、招聘、恋爱等其它形式。结论给出的这个“原因”可能只是一个数据点，远不是“那个原因”。感谢提交者在“Nigerian scammers”上加了引号，因为文章没有任何地方证明那些自称来自尼日利亚的信件真的来自尼日利亚。最后：诈骗（包括源自尼日利亚/由尼日利亚人实施的）是国际性的，因此“钱最终必须汇到尼日利亚，所以骗局终会暴露”的假设是错的；也就没有必须始终排除所有提到 Nigeria 的假阳性，可以用其它假阳性而不总是排除同一批人。TL;DR：如果采用定性方法，对“研究问题”的答案会更准确、更全面。
OoTheNigerian查看英文原文
At first glance, the conclusion of the paper seems very intelligently plausible however I believe understanding such reasons will be more accurate from qualitative rather than quantitative research. It should me noted that the particular format of scam discussed in this paper (the templates/models are called formats) is along the line of inheritance and criminal government officials. However, it does not address other formats such as lottery/employment/relationship scams to mention a few. This 'reason' given in the conclusion might be one data point but far from being 'The reason' Why Scammers Say They are from Nigeria. Thanks submitter for putting the quotation marks around Nigerian scammers because I did not see anywhere in the article that certified the letters calming to be from Nigeria were actually from Nigeria. A final note: Scams (including those originating from Nigeria/by Nigerians) are of international dimensions; therefore assuming a scam would have to be unraveled eventually since the money MUST be eventually sent to Nigeria is false. Therefore there is no compulsion to always eliminate those that are false positives to the word Nigeria. Other false positives can be used without eliminating the very same people all the time. TL;DR The answer to the 'research question' would be more accurate/inclusive if got form a qualitative method than quantitative.
质疑认为国籍声明主要是为了维持后续可信度和操作便利，而非单纯筛选。
我不认为这个结论正确。首先，我也见过来自巴基斯坦、伊朗和朝鲜的诈骗邮件。我认为黑客的挑战是编出一个足够可信的故事。自称来自一个被目标受众认为管理混乱、腐败的国家会有帮助；再把它和真实事件（比如某次真实政变）联系起来就更可信。但最终，一旦足够轻信的人跟进，如果你的尼日利亚口音或要求对方汇款到尼日利亚账户，却自称来自别处，就很难维持可信度。我认为这主要是尼日利亚骗子假装来自尼日利亚、伊朗骗子假装来自伊朗的原因。
mqzaidi查看英文原文
I don't think the conclusion is correct. First, I have seen mails from Pakistani, Iranian and North Korean scammers as well. I think the hackers challenge is to present a story that is credible enough. Claiming to be from a country that is perceived to be mismanaged and corrupt by the target audience helps. Linking it to some real event such as some real coup makes it even more credible. But finally, once someone gullible enough follows up - if you have a nigerian accent or ask them to mail to a nigerian account, claiming to be from some other place will make maintaining that credibility very difficult. I believe that is primarily why nigerian scammers pretend to be Nigerian, and Iranian scammers pretend to be Iranian.
质疑质疑“目标要么可行要么不可行”的二值假设，认为收益可能随攻击复杂度变化。
有意思的文章。不过我想知道这是否总是成立：> 我们考虑 N 个用户，其中 M 个是可行目标。可行是指这些目标被攻击时总能带来净收益 G，而不可行目标不带来任何收益。每次攻击成本为 C；因此攻击不可行目标会产生 C 的损失。这假设目标的可行性是布尔值：要么轻信，要么不轻信。但目标的可行性（或潜在收益）难道不可能取决于攻击的复杂程度吗？
bambax查看英文原文
Fascinating article. I wonder if this is always true though: > We consider a population of N users, which contains M viable targets. By viable we mean that these targets always yield a net profit of G when attacked, while non-viable targets yield nothing. Each attack costs C; thus attacking a non-viable target generates a loss of C This supposes that the viability of targets is boolean: you're either gullible or you're not. But isn't it possible that targets' viability (or profit potential) is a function of the sophistication of the attack?
历次讨论
- 2012Hacker News 讨论帖178 分 · 76 评
同领域还值得读
如何入侵一台已关机的电脑：在 Intel ME 中运行未签名代码
How to hack a turned-off computer, or running unsigned code in Intel ME
这篇 Black Hat 2017 白皮书讨论 Intel Management Engine（ME）的安全问题：如何在 ME 中运行未签名代码，以及攻破处于关机状态的电脑的相关…
安全与密码学2017 · 543 分 · 107 评专业 · 约 40 分钟编辑精选比特币：一种点对点的电子现金系统（2008）
Bitcoin: A Peer-to-Peer Electronic Cash System (2008)
中本聪 2008 年发表的比特币白皮书，提出了无需可信第三方的点对点电子现金系统。
安全与密码学2017 · 536 分 · 394 评入门 · 约 45 分钟编辑精选GPRS 加密算法 GEA-1 的密码分析表明存在故意弱点
Cryptanalysis of GPRS Encryption Algorithms GEA-1 suggest intentional weakness
首次公开了对 GPRS 加密算法 GEA-1 和 GEA-2 的密码分析攻击。
安全与密码学2021 · 487 分 · 107 评专业 · 约 90 分钟编辑精选Signal 消息协议的形式化安全分析
A Formal Security Analysis of the Signal Messaging Protocol
用形式化方法分析 Signal 消息协议（TextSecure）的安全性：作者在多阶段密钥交换模型下，借助自动化证明工具对协议的密钥协商与 Double Ratchet 密钥更新…
安全与密码学2016 · 353 分 · 230 评专业 · 约 120 分钟编辑精选A2：模拟恶意硬件
A2: Analog Malicious Hardware
论文研究如何在芯片设计阶段植入模拟电路形式的恶意硬件后门，使其难以被常规检测发现。
安全与密码学2016 · 315 分 · 94 评专业 · 约 75 分钟编辑精选