EFN Group Security

[Carl Karasti]

Starting over with "a new email address" is an option, but not as fool proof as you might think and not without a downside.

• To do this actually means abandoning this current group and starting a new group.

• One downside is that all of the archived past messages would be lost unless the original group is maintained. I don't know about anyone else, but I occasionally like to search back through old messages to find something that was posted. There has been a lot of interesting and valuable information that has been shared here. If we do move to a new group, this original one could be maintained.

• The Spammer undoubtedly has a "sleeper" email address as a member of the group, meaning this address is not used to post anything, but it is used to watch what is happening on the group – including me posting this message.

• This "sleeper" address will know — through group messages — about any plan to create a new group and how to join it. It will request to become a member and the request will be approved without any vetting to confirm that it is a real person or to reveal that it is fake. BOOM, the spammer will still be in the group where they will wait patiently for a while and then start spamming again. These perpetrators are, if anything, persistent if they feel there is any chance of successfully exploiting unwary victims. It "costs" them nothing to do this and often enough leads to sufficient success to make their persistence quite profitable.

• There is no easy or fool proof way to vett every membership request to eliminate scammer spammers. Nevertheless, some effort should always be made to try to verify the legitimacy of any new, unknown address. I'm sure that this has never been done here.

• Google Groups does not provide any tools to help verify that email addresses are real people. Have you noticed a theme here — that Google is not really at all interested in our privacy or our security? We are their products and user engagement is what makes us productive for them! Spammer messages count as a positive in measuring user engagement! This is true for all online social media — we are being exploited for our convenience of communicating with each other for FREE. Nothing is free.

• Not moving to a new group maintains easy access to our archived messages.

• Not moving to a new group also maintains any "sleeper" address" as a member, BUT having everyone on moderated status so all posts need moderator approval means a spammer will never be able to post inappropriate messages.

• Note that while most spam messages have been obvious to most here (cleaning heating ducts) there have been some offering an item for sale. Hopefully no one has fallen for that scam. This is NOT a group for selling stuff, even if supposedly naturalist related.

• NOTE also that the spammer already has each of our group email addresses, simply because they are a group member.

• Is Google Groups our only option? No. There is once service that I think would be better, but moving would of course mean abandoning this group and starting a whole new one. But .... even that would not guarantee a perfect solution.

Carl Karasti