#should have started my essay instead | Explore Tumblr Posts and Blogs

actuallyjustabiscuit · 3 months

Text

Ok thoughts 👏thoughts👏Everyone gather around I have thoughts about this!

Episode 2 was clearly the Pomni episode. We got to see her character get a little more fleshed out and we also got a glimpse of what motivates her which is great.

With this tweet we have solid confirmation on who the upcoming episodes will center on (thanks for not making us guess, Goose) and this lineup is really interesting.

First fascinating thing is that Kinger and Zooble share a spotlight in ep 3. Why is that? Everyone else gets their own dedicated episodes so why are they unique in that regard? What connects them?

Well, I have one idea!

So we know since the pilot that Kinger has been the one to have lived in the Circus the longest out of all of them. We’re still not sure if he was in fact the 1st human to be trapped (maybe we’ll find out in the next episode) but he definitely has the most seniority, both in age and in length of entrapment.

We also know that Zooble was the most recent character to get stuck before Pomni (and considering their attitude, it may have even been quite a while beforehand) AND is the youngest character next to Jax (they even share the same age, which could be a coincidence but it feels too deliberate of a choice).

Which means ep 2 will simultaneously focus on the oldest and the youngest of the characters.

I’m actually curious as to what their dynamic will be because they haven’t really interacted much in the pilot (and like not at all in episode 2), if they end up interacting in ep 3 at all. But mostly I’m excited to see them more fleshed out with hopefully Pomni getting the chance to bond with them (either together or separately).

My guess is that the purpose for them to share focus on an episode is to get perspective from someone who’s been there the longest and has seen more people come and go than anyone else vs. someone who was just recently in Pomni’s shoes and had probably a much different first day experience (we know Zooble cared enough about Kaufmo to personally organize his funeral so they may have some…feelings about who’s essentially his replacement).

Ep3 is also supposedly Gooseworx’s most anticipated episode so I’m extra excited.

Next we have Gangle for episode 4. I honestly don’t have a lot to say about her or the significance in her episode placement outside of her being the closest in age to Pomni (being only a year older). The only hint we get about what her episode will possibly consist of will be on how reliant she is on her ComedyMask to feel happy, which will be very interesting and we might even get some confirmation on whether her avatar was programmed with that feature upon entering the Circus or if it was an add on of sorts by Caine to help keep her sane. A pretty shitty feature if it can’t last for very long but it does make for a nice metaphor about how fragile her facade is (girl is literally masking).

Actually I don’t think her and Pomni have actually exchanged words yet in the show. Wouldn’t it be funny if they don’t up until her episode. Like Pomni is so caught up in between whatever mess episode 3 has in store for Kinger and Zooble that the two of them never actually talk and it just keeps getting more awkward. Gangle wants to talk to her but is so self-conscious about her Tragedy self that she’ll only feel safe to have a conversation if she has her mask, but it just keeps breaking before she even gets the chance.

Again this is all just speculation, if they actually end up talking in episode 3 I’ll…make ship art of them.

Yeah

Anyway, episode 5. The one I’m personally waiting for because y’all should know what I’m about by now.

*Warning: Unhinged, borderline psychotic tangent incoming*

I swear to god if Pomni and Ragatha don’t have a fucking conversation before ep 5 I will launch myself into the sun. I’ll take anything, I just need them to get real for a second. I NEED to know the extent of this woman’s damage. It has to be explored, analyzed, and dissected and I will do so with gusto when the day comes. None of these characters will be safe from my scrutiny, but Ragatha oh ho ho, you have been living rent free in my head for too long, madame. You WILL pay your dues and I intend to collect in every episode until there is not corner of your unsound mind that I have not examined in great detail!

Ahem *Straightens tie* Ok back to business

So yeah, Ragatha.

It may be because we’ve only had 2 episodes but I can’t help but feel like we’re supposed to see Ragatha as a sort of deuteragonist since out of all of the supporting characters she’s so far been getting the most focus aside from Jax, and we’ll get to him in a minute (I promise that’s not just me being biased, or maybe it is, I don’t know, you tell me).

In just two episodes we’ve seen more of what makes her tick compared to anyone else. And of the main cast she’s been the ONLY one to make any kind of connection to the main character and have enough of a meaningful interaction with her to leave an impression.

But this is what really clinched her role as a deuteragonist for me, she’s so far been one of the few to have the narrative briefly shift to her perspective to give us significant character moments like these:

The show REALLY wants us to see just how NOT ok she is.

If she’s meant to be the heart of the group, her heart already can’t take much more damage. Her friendship (if you can call it that, it’s so painfully one sided right now) with Pomni clearly means a lot to her, so much so that her entire sense of self worth seems to be tied to it (and if you’ve been paying attention, she doesn’t have a lot of that as it is). It would be nice to see their connection gradually grow before her designated episode, where she might experience actual growth for herself.

And if episode 2 is any indication of how this show preserves friendships well…

Yeah, I don’t think she’s gonna make it.

In fact, I’m willing to bet actual money that she’s either gonna abstract in episode 5 or episode 6.

Which brings us to Jax’s episode! The other deuteragonist…tritagonist? He definitely shares some degree of significant narrative focus along with Pomni and Ragatha. He’s both an active antagonist force and one of the only characters to drive the plot forward every time he’s on screen (then there’s that weird thing where he keeps breaking the fourth wall).

He has so much significance in the story that Gooseworx gave him his own bullet point in her list of content warnings (this could also be a joke, but I mean it would be funny to see just how despicable they can make this character).

Gooseworx also described Jax and Pomni’s relationship in the show as “messy”. After episode 2, I don’t think she considers him as a candidate for any kind friendship like she did for the others, and who could blame her? In just two days the guy abandoned her to deal with an abstraction and chucked her out of a truck. He’s no one’s favorite person, and he relishes that. Bunnyboy definitely has some issues that Pomni would pick up on the more she’s forced to spend time with him. To the point where I can see her trying to eventually form some kind of bridge because, as her previously established character motivation implies, she’s not the kind of person to intentionally leave anyone high and dry. But unlike the rest of the crew, I don’t think Jax would be inclined to change for the better just because someone took pity on him. He seems like the kinda guy to dig his heels in and commit to his bad behavior out of spite.

And for his episode to come after Ragatha’s, why do I get the feeling the reason Gooseworx went so far as to preemptively apologize to bunnydoll shippers specifically is because he’s gonna cause something really really bad to happen to her (could be abstraction, could even be something much worse) that he would come to sorely regret.

And oh boy would that evoke some feelings in everyone!

I feel like if that is indeed the direction this show is going, the rest of the episodes will really be something.

I’m also certain Caine will get his own episode but right now he is very much an antagonist to these characters. I wouldn’t go so far as to call him a villain, but he’s certainly not someone Pomni is keen on sympathizing with, at least not currently.

Thanks again @lilyclawthorne for helpfully providing me with the tweet so I can give some context for my ramblings of the week!

#phew finally done with this #I did NOT mean for this to get so long #I should be asleep but decided to do this instead cuz it’s been giving me serious brain rot #I feel like I should start making a specific tag for my unhinged essays #Biscuit Bakes?#Ah whatever it’ll come to me #character analysis #the amazing digital circus #tadc #tadc pomni #tadc kinger #tadc zooble #tadc gangle #tadc ragatha #tadc jax #tadc caine #tadc headcanon #I have taken WAY to many screenshots of the doll. I am not well #I feel like I could have added some more screenshots about the hints Gooseworx has given for the show but I’m too lazy to go looking

224 notes · View notes

mostlysignssomeportents · 8 months

Text

How I got scammed

If you'd like an essay-formatted version of this post to read or share, here's a link to it on pluralistic.net, my surveillance-free, ad-free, tracker-free blog:

https://pluralistic.net/2024/02/05/cyber-dunning-kruger/#swiss-cheese-security

I wuz robbed.

More specifically, I was tricked by a phone-phisher pretending to be from my bank, and he convinced me to hand over my credit-card number, then did $8,000+ worth of fraud with it before I figured out what happened. And then he tried to do it again, a week later!

Here's what happened. Over the Christmas holiday, I traveled to New Orleans. The day we landed, I hit a Chase ATM in the French Quarter for some cash, but the machine declined the transaction. Later in the day, we passed a little credit-union's ATM and I used that one instead (I bank with a one-branch credit union and generally there's no fee to use another CU's ATM).

A couple days later, I got a call from my credit union. It was a weekend, during the holiday, and the guy who called was obviously working for my little CU's after-hours fraud contractor. I'd dealt with these folks before – they service a ton of little credit unions, and generally the call quality isn't great and the staff will often make mistakes like mispronouncing my credit union's name.

That's what happened here – the guy was on a terrible VOIP line and I had to ask him to readjust his mic before I could even understand him. He mispronounced my bank's name and then asked if I'd attempted to spend $1,000 at an Apple Store in NYC that day. No, I said, and groaned inwardly. What a pain in the ass. Obviously, I'd had my ATM card skimmed – either at the Chase ATM (maybe that was why the transaction failed), or at the other credit union's ATM (it had been a very cheap looking system).

I told the guy to block my card and we started going through the tedious business of running through recent transactions, verifying my identity, and so on. It dragged on and on. These were my last hours in New Orleans, and I'd left my family at home and gone out to see some of the pre-Mardi Gras krewe celebrations and get a muffalata, and I could tell that I was going to run out of time before I finished talking to this guy.

"Look," I said, "you've got all my details, you've frozen the card. I gotta go home and meet my family and head to the airport. I'll call you back on the after-hours number once I'm through security, all right?"

He was frustrated, but that was his problem. I hung up, got my sandwich, went to the airport, and we checked in. It was total chaos: an Alaska Air 737 Max had just lost its door-plug in mid-air and every Max in every airline's fleet had been grounded, so the check in was crammed with people trying to rebook. We got through to the gate and I sat down to call the CU's after-hours line. The person on the other end told me that she could only handle lost and stolen cards, not fraud, and given that I'd already frozen the card, I should just drop by the branch on Monday to get a new card.

We flew home, and later the next day, I logged into my account and made a list of all the fraudulent transactions and printed them out, and on Monday morning, I drove to the bank to deal with all the paperwork. The folks at the CU were even more pissed than I was. The fraud that run up to more than $8,000, and if Visa refused to take it out of the merchants where the card had been used, my little credit union would have to eat the loss.

I agreed and commiserated. I also pointed out that their outsource, after-hours fraud center bore some blame here: I'd canceled the card on Saturday but most of the fraud had taken place on Sunday. Something had gone wrong.

One cool thing about banking at a tiny credit-union is that you end up talking to people who have actual authority, responsibility and agency. It turned out the the woman who was processing my fraud paperwork was a VP, and she decided to look into it. A few minutes later she came back and told me that the fraud center had no record of having called me on Saturday.

"That was the fraudster," she said.

Oh, shit. I frantically rewound my conversation, trying to figure out if this could possibly be true. I hadn't given him anything apart from some very anodyne info, like what city I live in (which is in my Wikipedia entry), my date of birth (ditto), and the last four digits of my card.

Wait a sec.

He hadn't asked for the last four digits. He'd asked for the last seven digits. At the time, I'd found that very frustrating, but now – "The first nine digits are the same for every card you issue, right?" I asked the VP.

I'd given him my entire card number.

Goddammit.

The thing is, I know a lot about fraud. I'm writing an entire series of novels about this kind of scam:

https://us.macmillan.com/books/9781250865878/thebezzle

And most summers, I go to Defcon, and I always go to the "social engineering" competitions where an audience listens as a hacker in a soundproof booth cold-calls merchants (with the owner's permission) and tries to con whoever answers the phone into giving up important information.

But I'd been conned.

Now look, I knew I could be conned. I'd been conned before, 13 years ago, by a Twitter worm that successfully phished out of my password via DM:

https://locusmag.com/2010/05/cory-doctorow-persistence-pays-parasites/

That scam had required a miracle of timing. It started the day before, when I'd reset my phone to factory defaults and reinstalled all my apps. That same day, I'd published two big online features that a lot of people were talking about. The next morning, we were late getting out of the house, so by the time my wife and I dropped the kid at daycare and went to the coffee shop, it had a long line. Rather than wait in line with me, my wife sat down to read a newspaper, and so I pulled out my phone and found a Twitter DM from a friend asking "is this you?" with a URL.

Assuming this was something to do with those articles I'd published the day before, I clicked the link and got prompted for my Twitter login again. This had been happening all day because I'd done that mobile reinstall the day before and all my stored passwords had been wiped. I entered it but the page timed out. By that time, the coffees were ready. We sat and chatted for a bit, then went our own ways.

I was on my way to the office when I checked my phone again. I had a whole string of DMs from other friends. Each one read "is this you?" and had a URL.

Oh, shit, I'd been phished.

If I hadn't reinstalled my mobile OS the day before. If I hadn't published a pair of big articles the day before. If we hadn't been late getting out the door. If we had been a little more late getting out the door (so that I'd have seen the multiple DMs, which would have tipped me off).

There's a name for this in security circles: "Swiss-cheese security." Imagine multiple slices of Swiss cheese all stacked up, the holes in one slice blocked by the slice below it. All the slices move around and every now and again, a hole opens up that goes all the way through the stack. Zap!

The fraudster who tricked me out of my credit card number had Swiss cheese security on his side. Yes, he spoofed my bank's caller ID, but that wouldn't have been enough to fool me if I hadn't been on vacation, having just used a pair of dodgy ATMs, in a hurry and distracted. If the 737 Max disaster hadn't happened that day and I'd had more time at the gate, I'd have called my bank back. If my bank didn't use a slightly crappy outsource/out-of-hours fraud center that I'd already had sub-par experiences with. If, if, if.

The next Friday night, at 5:30PM, the fraudster called me back, pretending to be the bank's after-hours center. He told me my card had been compromised again. But: I hadn't removed my card from my wallet since I'd had it replaced. Also, it was half an hour after the bank closed for the long weekend, a very fraud-friendly time. And when I told him I'd call him back and asked for the after-hours fraud number, he got very threatening and warned me that because I'd now been notified about the fraud that any losses the bank suffered after I hung up the phone without completing the fraud protocol would be billed to me. I hung up on him. He called me back immediately. I hung up on him again and put my phone into do-not-disturb.

The following Tuesday, I called my bank and spoke to their head of risk-management. I went through everything I'd figured out about the fraudsters, and she told me that credit unions across America were being hit by this scam, by fraudsters who somehow knew CU customers' phone numbers and names, and which CU they banked at. This was key: my phone number is a reasonably well-kept secret. You can get it by spending money with Equifax or another nonconsensual doxing giant, but you can't just google it or get it at any of the free services. The fact that the fraudsters knew where I banked, knew my name, and had my phone number had really caused me to let down my guard.

The risk management person and I talked about how the credit union could mitigate this attack: for example, by better-training the after-hours card-loss staff to be on the alert for calls from people who had been contacted about supposed card fraud. We also went through the confusing phone-menu that had funneled me to the wrong department when I called in, and worked through alternate wording for the menu system that would be clearer (this is the best part about banking with a small CU – you can talk directly to the responsible person and have a productive discussion!). I even convinced her to buy a ticket to next summer's Defcon to attend the social engineering competitions.

There's a leak somewhere in the CU systems' supply chain. Maybe it's Zelle, or the small number of corresponding banks that CUs rely on for SWIFT transaction forwarding. Maybe it's even those after-hours fraud/card-loss centers. But all across the USA, CU customers are getting calls with spoofed caller IDs from fraudsters who know their registered phone numbers and where they bank.

I've been mulling this over for most of a month now, and one thing has really been eating at me: the way that AI is going to make this kind of problem much worse.

Not because AI is going to commit fraud, though.

One of the truest things I know about AI is: "we're nowhere near a place where bots can steal your job, we're certainly at the point where your boss can be suckered into firing you and replacing you with a bot that fails at doing your job":

https://pluralistic.net/2024/01/15/passive-income-brainworms/#four-hour-work-week

I trusted this fraudster specifically because I knew that the outsource, out-of-hours contractors my bank uses have crummy headsets, don't know how to pronounce my bank's name, and have long-ass, tedious, and pointless standardized questionnaires they run through when taking fraud reports. All of this created cover for the fraudster, whose plausibility was enhanced by the rough edges in his pitch - they didn't raise red flags.

As this kind of fraud reporting and fraud contacting is increasingly outsourced to AI, bank customers will be conditioned to dealing with semi-automated systems that make stupid mistakes, force you to repeat yourself, ask you questions they should already know the answers to, and so on. In other words, AI will groom bank customers to be phishing victims.

This is a mistake the finance sector keeps making. 15 years ago, Ben Laurie excoriated the UK banks for their "Verified By Visa" system, which validated credit card transactions by taking users to a third party site and requiring them to re-enter parts of their password there:

https://web.archive.org/web/20090331094020/http://www.links.org/?p=591

This is exactly how a phishing attack works. As Laurie pointed out, this was the banks training their customers to be phished.

I came close to getting phished again today, as it happens. I got back from Berlin on Friday and my suitcase was damaged in transit. I've been dealing with the airline, which means I've really been dealing with their third-party, outsource luggage-damage service. They have a terrible website, their emails are incoherent, and they officiously demand the same information over and over again.

This morning, I got a scam email asking me for more information to complete my damaged luggage claim. It was a terrible email, from a noreply@ email address, and it was vague, officious, and dishearteningly bureaucratic. For just a moment, my finger hovered over the phishing link, and then I looked a little closer.

On any other day, it wouldn't have had a chance. Today – right after I had my luggage wrecked, while I'm still jetlagged, and after days of dealing with my airline's terrible outsource partner – it almost worked.

So much fraud is a Swiss-cheese attack, and while companies can't close all the holes, they can stop creating new ones.

Meanwhile, I'll continue to post about it whenever I get scammed. I find the inner workings of scams to be fascinating, and it's also important to remind people that everyone is vulnerable sometimes, and scammers are willing to try endless variations until an attack lands at just the right place, at just the right time, in just the right way. If you think you can't get scammed, that makes you especially vulnerable:

https://pluralistic.net/2023/02/24/passive-income/#swiss-cheese-security

Image: Cryteria (modified) https://commons.wikimedia.org/wiki/File:HAL9000.svg

CC BY 3.0 https://creativecommons.org/licenses/by/3.0/deed.en

#pluralistic #social engineering #phishing #ai #swiss cheese security #infosec #finance #fraud #carding

10K notes · View notes