I am consistently surprised by people's attitudes as I read HN comments.
Full disclosure, my old employer was very serious about phishing prevention (we sat on a ton of IP and people were out to get it) and did testing of this type as well. I did fall for a phish test around last review season because the phishing email had something about reviews in it.
Let's be adult about it - it was a good test and I failed it because I wasn't vigilant enough.
The fact that GoDaddy's email was "tempting for people around holiday season to click on" is - guess what - exactly what a moderately-sophisticated phishing attack would look like.
One of the things IT teaches employees to look for in phishing emails is language that either doesn't make sense or seems designed to "get your guard down and act on it."
In GoDaddy's case it included language like "it's free money, claim it now." Really - if you slowed down for a sec and thought about security, is this the language in which your employer emails you? Also, why does your employer need you to fill out any forms about your location - they know where you are.
For all the talk on HN about security and companies not taking it seriously enough, here's a great example of a company taking it seriously (to the point of discomfort) to teach their staff about what phishing could look like, and HN is somehow objecting.
PS: I bet there are no consequences for failing this test other than needing to retake the training which is right because the people who fell for it do need the reminder. If this was a real phish they'd have leaked real data. Perhaps even your data.
Full disclosure, my old employer was very serious about phishing prevention (we sat on a ton of IP and people were out to get it) and did testing of this type as well. I did fall for a phish test around last review season because the phishing email had something about reviews in it.
Let's be adult about it - it was a good test and I failed it because I wasn't vigilant enough.
The fact that GoDaddy's email was "tempting for people around holiday season to click on" is - guess what - exactly what a moderately-sophisticated phishing attack would look like.
One of the things IT teaches employees to look for in phishing emails is language that either doesn't make sense or seems designed to "get your guard down and act on it."
In GoDaddy's case it included language like "it's free money, claim it now." Really - if you slowed down for a sec and thought about security, is this the language in which your employer emails you? Also, why does your employer need you to fill out any forms about your location - they know where you are.
For all the talk on HN about security and companies not taking it seriously enough, here's a great example of a company taking it seriously (to the point of discomfort) to teach their staff about what phishing could look like, and HN is somehow objecting.
PS: I bet there are no consequences for failing this test other than needing to retake the training which is right because the people who fell for it do need the reminder. If this was a real phish they'd have leaked real data. Perhaps even your data.