We fucking love people up in this bitch 🌈

DNI: Minors, terfs, racists, sexist, transphobes, homophobes

[bowlby4]

[quixoticanarchy]

I do think it's kind of funny how john green wrote a book about tuberculosis that brought a lot of renewed attention to the subject and he's since become the darling of the tb world, speaks at tb conferences, my dad and every other tb researcher I know is absolutely smitten with him, and they'll be like "we love this guy! have you heard of him??" and I have to be like well yes, I have. for other reasons

[sizzlingsandwichperfection-blog]

"You mean the guy who got cyberbullied off of tumblr by 14-year-old anarchomarxists but then triumphantly returned as a coffee company?"

[pleasemayiiplease]

[transfemmbeatrice]

[thememedaddy]

[imaveryevilgirl]

seeing a tumblr mutual's post on a different platform is like. no. get back here. wait. that's MY mentally ill friend you're talking to

[persianmom]

[depsidase]

[mia-down-under]

[phillytransfemme]

The mass surveillance of private and public spaces needs to be stopped. Cover the camera in your appliance, cut the cord to Big Brother.

[cannibalchicken]

[beardedmrbean]

[389]

[lil-peebo]

[jessica-problems]

probably speaks to something unwell in the collective tumblr psyche that those absurdly bleak bad luck brian memes are the only survivors of, like, an entire genre of different advice animal image macros.

[sunburnt-brian]

[sreegs]

stolen from prev @fallout-lou-begas 's tags

[tahthetrickster]

so there’s a cool new tumblr scam i’m getting nonstop pinged about and while i’m a millennial who works at a fake email job and am thus very used to “how to spot a stupid fake phishing attempt” because i have to do annual training on it, im aware that not everybody has had to do phishing training so here’s some obvious tells on

How To Spot A Social Media Phishing Attempt

it’s basically always going to be something super urgent-sounding. an error in a verification process. a mark on your account. you owe money to people who are going to put you in jail if you don’t pay. if you’ve ever had a discord scam get one of your friends, you’ve probably seen the “omg i reported you by accident!!!” thing. they want it to seem important and urgent so you feel you don’t have any time to think about whether or not something sounds Off

very often on social media websites, it’ll have stupid nonsense urls like these accounts do. official brands will never contact you from random accounts with long strings of numbers as their usernames/urls

in fact, 99% of the time, websites won’t contact you through the website at all. if they do, it will be through a popup or banner on the site itself. they won’t contact you through replies like this. websites do the VAST majority of their communication through email, since they know what email address is associated with your account.

so now let’s look at the actual message they’re tagging me in and see what else we can see

oh brother! well, let’s look at some more tells

starting off the message with the very generic “dear user.” any official communication that’s intended to be for you, personally, (so, e.g., not like… a newsletter) from a website or service will address you by name or username. it takes almost zero effort to personalize communications. if they can’t personalize it, that’s a red flag

ending the message with a list of users its contacting. that’s terrible information security! no users should have any information about the internal status of any account but their own. a real communication will only ever be sent to you!

vaguely threatening implications of what may happen to your account. any legitimate communication about “restrictions” on your account will tell you what those restrictions are. remember what i said about them trying to make you panic with urgency? you have “restrictions!” that’s terrible! don’t you want to resolve those quickly?!?

this is a reply on a post. no website is going to be contacting you about your account status in the replies for anything

also, it wants you to go look at the post for further directions on how to fix your “account restrictions.” that’s ridiculous. official communications won’t make you go look somewhere else for next steps. they’ll just include the next steps right there in the initial communication.

so let’s take a final look at the post itself that it wants us to go view and follow

ooh they have a graphic this time! okay so.

they’re still trying to make this seem like a very urgent issue with your account with the “within 24 hours” warning, trying to spur you into quick decisions that you don’t think through logically. don’t let them! websites don’t give notices that short!

they’re doing those things again that i mentioned before—generic message opening (“dear tumblr user”), including a bunch of users in the same message (in the post replies, but still), contacting you through a post instead of email (it just doesn’t happen!)

also, notice that there’s a big discrepancy between the reply and the post about what the issue is. in the reply, the issue is “suspicious activity on your account,” and on the post the issue is “a verification issue.” inability to keep the story straight is basically a guarantee that it’s fake!

it’s trying to get you to a secondary location. websites don’t do secondary locations. don’t click on links that clearly aren’t the website they allege to be. tumblr isn’t going to send you to a place called tumblrauthprocess dot com. they already pay for tumblr dot com! if they really had a method of authentication you needed to complete, it would be at like tumblr dot com slash support slash auth or something like that.

even if you know it’s a fake link and aren’t gonna type anything into it, it’s good infosec practice to not click them anyway. they might put malware on your device.

offering a potential reward—tumblr premium in this case—for doing what the post says. it’s the flip side of the “trying to scare you into acting fast” thing. if they can’t appeal to your panic to make you act quickly, they’ll try to appeal to your desire for Stuff instead. companies might occasionally compensate you for their screw-ups, but they won’t advertise that ahead of time—that not only makes the company look bad (their system screws up so much they have to advertise that you get stuff when it happens??) it also increases the likelihood of bad actors trying to purposefully get the system to screw up just to get free stuff

spotting phishing attempts is easy once you know what to look for. and remember to report the account for the attempt instead of just blocking it—blocking keeps you from seeing that account trying to scam you anymore, but reporting gets the account actioned on so your friends who aren’t so scam-savvy don’t accidentally get phished

now go forth and revel in your knockoff white collar phishing training module knowledge

[hyrax-and-gooning]

I work infosec and deal with the aftermath of people falling for phishing emails.

Please educate your elders and juniors

[depsidase]

[quadriceps-deactivated20171230]

rare fish. please no questions

[cerafuentes]

why would a fish need sunglasses

[quadriceps-deactivated20171230]

what the hell i just say

[pukicho]

I have animalized you. Now, roam free:

[hyrax-and-gooning]

Finally