3 ms·
Looking at various examples of security advice we find that the advice is complex and growing, but the benefit is largely speculative or moot. For example, much
by blasdel 17y ago
Looking at various examples of security advice we find
that the advice is complex and growing, but the benefit
is largely speculative or moot. For example, much of the
advice concerning passwords is outdated and does little
to address actual threats, and fully 100% of certificate
error warnings appear to be false positives. Further, if
users spent even a minute a day reading URLs to avoid
phishing, the cost (in terms of user time) would be two
orders of magnitude greater than all phishing losses.
- xtho 17y agoThanks for posting an abstract of the article's abstract. May I humbly ask if you could condense that a little further in order to reduce reading costs for those of us for who file almost anything longer than say 10 words under tl;dr
- jrp 17y ago1) I do remember a post a while back where a Firefox user submitted a bug report due to actually encountering a MITM attack, so not 100% are false positives. (the post: http://news.ycombinator.com/item?id=353376 http://news.ycombinator.com/item?id=353376 ) 2) A minute a day may outweigh the phishing losses, but who says you need to spend a minute? My browser has warned me once in the past 4 months about a possible phishing site, so I spent something like 1 minute in 120 days to check it out.