9

I guess such a topic, while related to both psychology and hacking, is essentially belonging a site like this.

On the other hand, it would not be the best idea to give people advice for morally questionable acts.

What about this topic?

1
  • I would like it to be.
    – user20
    Jun 27, 2017 at 18:39

5 Answers 5

Reset to default
10

I would say that social engineering in on-topic, as it covers many aspects of interpersonal communication. Let's push for it being on-topic.

7

It should be on topic (but we shouldn't teach people how to do it).

Definition

Social engineering is defined on Wikipedia as

Social engineering [...] refers to psychological manipulation of people into performing actions or divulging confidential information.

It clearly is a set of interpersonal skills and as such should be on topic.

Teaching Social Engineering?

Social engineering is not necessarily nefarious. Getting a store clerk to accept your return and give a refund, or getting a (larger) compensation for an inconvenience you've suffered, can also be called "social engineering". This should be on topic.

And when it comes to social engineering of the nefarious kind, asking how to defend against that should also be on topic.

If you ask a question "I want to hack the Pentagon, how do I do that?" on Stack Overflow or Information Security, it would very likely be closed right away. If a question on this stack would ask "I want to get someone's password, how do I do that?", I hope the same would happen.

But the techniques used are just general interpersonal skills, which can be used for good or for bad, and they should be on topic.

4
  • 1
    agree not to teach it, but to recognise and avoid it
    – user57
    Jul 2, 2017 at 0:17
  • So rename to 'persuasive techniques'?
    – marcellothearcane
    Jul 22, 2017 at 19:02
  • I second your answer, though I think "how can I identify being the victim of social engineering" or "how to protect myself against social engineering" would be closed on Stackoverflow right away too.
    – try-catch-finally
    Feb 24, 2018 at 13:45
  • @try-catch-finally but that's because social engineering is off topic there. Asking how to protect against hacking would be on topic (if specific enough).
    – SQB
    Feb 24, 2018 at 13:50
7

Social engineering, the process of getting information (passwords, for example) from people that they don't want to give, should not be on-topic. If the question is in the context of computer security, it should go in that topic-specific SE.

The more general topic of "how to manipulate people against their will" seems on-topic to me, but I have concerns about promoting questions asking how to do unethical behavior. The question of morality is probably a separate meta question.

11
  • It could be my ethical self masquerading as something else, but for some reason, "people manipulation" doesn't sound like interacting with other people... That's more like it would be psychiatry or something.
    – Zizouz212
    Jun 27, 2017 at 21:22
  • 1
    There's some kind of manipulation that's acceptable, I think. "My family has hateful views and refuses to change; how do I encourage them to improve?" is an interpersonal question about manipulating people, but it's also interaction and may be ethical.
    – Gregory Avery-Weir
    Jun 27, 2017 at 21:27
  • That example is cool with me. I think I just saw the "manipulate people against their will" and my inner self is like "nooooooooooooooo"
    – Zizouz212
    Jun 27, 2017 at 21:29
  • I agree that questions about manipulation should be considered on-topic, at least for now. It's early enough that we should let it happen(within reason) and observe the result. Some questions, like those around making white lies, may skirt ethics but the ends can still justify the means.
    – Ten Bitcomb
    Jun 28, 2017 at 4:18
  • That is a very narrow definition of social engineering, although it is a common one.
    – SQB
    Jun 28, 2017 at 13:52
  • @tuskiomi I clarified that my password example was just an example; do you have an alternate definition? The question-asker did not provide one.
    – Gregory Avery-Weir
    Jun 28, 2017 at 16:30
  • @GregoryAvery-Weir I think that you should change your answer to getting info (for example, passwords) ... that they shouldn't give to start. That makes it clear that passwords isn't part of the definition.
    – user20
    Jun 28, 2017 at 16:32
  • @tuskiomi Done.
    – Gregory Avery-Weir
    Jun 28, 2017 at 16:33
  • 1
    Thank you! There's a reason i'm here, and it's not because I like changing answers, haha.
    – user20
    Jun 28, 2017 at 16:35
  • 2
    personal input. For me, the first name question would be social engineering. it's attempting to get somebody to let out some information (which isn't confidential) and using deception to avoid a negative result. totally on topic for this site.
    – user20
    Jun 28, 2017 at 16:40
  • Since social engineering per definition is about tricking people to do things that they wouldn't normally do (giving passwords or, more commonly, access) is just one example. It could not only be applied to computer technology but to any engineering profession, social security (guards, police), food production, medicine, etc. And asking such a question on those sites (if they even exist) is not on-topic (except for the informational security stack).
    – try-catch-finally
    Feb 24, 2018 at 13:41
5

There are some highly negative aspects to social engineering. How to do it should be off-topic for this site. How to defend against it is what should be on-topic.

So let's be clear about what the most common definition of this topic is. A quick search of the Internet shows basically the following (allowing for variations for a topic that probably morphs over time).

As I understand it, social engineering is:

So it boils down to a simple concept: Are we here to help people or to hurt people.

You may want to say that I will trick people (socially engineer them) for "the greater good". You are still tricking them. You are still manipulating them. So you are saying that the end justifies the means. I'm sorry, but I will never trick someone because my "superior intellect" dictates that it is for their own good.

This site should be about helping people. If we want to do that as a community, then when it comes to social engineering, we should help people to recognize and avoid/prevent its detrimental effects.

Original post:

How to conduct social engineering on another person. NO.

How to detect, guard against, properly react to social engineering. YES.

5
  • Thank you for your update! While I agree in a general sense that we are not here to harm people, I don't agree with your "no" because there's a large grey area. White lies would be the most obvious example. Another would be cultivating a following, which almost always requires a level of deception, but the level of "harm" being done is unclear or not provable. I would argue that courtship often starts out with a high level of manipulation, but with a mutually beneficial ending. It's topics like those that I would find permissible, hence my "yes". I will have to think about this more.
    – Ten Bitcomb
    Jun 28, 2017 at 6:37
  • Any good set of instructions to defend against it has to describe likely "attack vectors". Thus, the distinction between the two is pretty useless. Mind, that I'm not advocating for a "Guide to Social Engineering". Just have a look at Information Security SE, defense always requires the knowledge about the possible attacks.
    – Helmar
    Jul 3, 2017 at 18:45
  • I see your point about good instructions. However the "useless" distinction you refer to makes all the difference in the world. Ends and Means are quite different. There are many examples outside of this site that illustrates this same concept.
    – John Mod
    Jul 3, 2017 at 21:14
  • Social engineering can be used for good, and not just in the sense of "well it'll help them in the long run". For example, social engineering is part of any good penetration tester's kit, allowing them to find out exactly what people fall for and then give advice on how to prevent that in the future. The fact is, you have misunderstood social engineering quite badly.
    – forest
    Nov 15, 2018 at 7:25
  • Please refer to my second sentence: "How to defend against it is what should be on-topic". It appears your "give advice comment" falls squarely in this category.
    – John Mod
    Nov 15, 2018 at 20:54
4

Wouldn't any really blatant attempt at:

How do I get [person] to do [x] against their will?

... pretty much immediately fall into the category of 'too broad' and be closed appropriately? I hope it would be, because that would almost certainly apply here :)

If you're really on the lookout for something possibly sinister, as in someone actively trying to do this, you're going to be spotting for someone working through questions on earning trust, and other much much narrower things. I don't think any serious attempt at social engineering (as in, how to do it to someone else) would actually come to light here.

What are tricks I can use to quickly recover a talkative audience if I'm speaking in public? That's pretty benign, but still social engineering depending on how I ask it and how you interpret it.

For now, I recommend allowing it, and seeing if an actual problem comes to pass. If one does, then you have a real world example to discuss, and the problem stops being imaginary or theoretical.

I think the possibilities are just too many for a blanket "yay or nay" here.

1
  • Unfortunately, like the parenting site, it seems like a large segment of this site wants broad questions to be allowed.
    – curiousdannii
    Jun 29, 2017 at 21:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .