3 ms·

I read the first lines and thought immediately of all those e-mails marked IMPORTANT coming from "my bank" that request I immediately enter my username and pass

I read the first lines and thought immediately of all those e-mails marked IMPORTANT coming from "my bank" that request I immediately enter my username and password somewhere for "security". Teaching blind compliance with any (unauthenticated) request based on "security" is the one way we could make the situation even worse.

HCIdivision17 11y ago
It's a pretty big deal. When everything starts at urgent and gets worse from there, people will just rescale the noise to be more understandable. It's just like the joke about sitting down and assigning points to a task and finding out everything is 100 or all bugs are critical or all tasks are top priority. The meta joke here is that is some ways every security issue is critical, but if everyone is immune to the fear then escalation will feel like the only choice. Either you slowly discharge that stress immunity by being sensibly mellow, or you start packing heat to 'convince' everyone to reboot NOW. (There's probably room for some amount of finesse between these two extremes.) EDIT: There's two terrible responses that seem to come out of this. Either no one gives a damn, or no one gives a damn and just does whatever you say. The first is bad because nothing gets fixed, and the second is bad for `red_admiral's reasons (users treat anything that looks like a security rant as a EULA and just do whatever it says).
- acveilleux 11y ago
  > When everything starts at urgent and gets worse from there, people will just rescale the noise to be more understandable. I really like that phrasing. I've been intuitively thinking along the same line but rescale is just the perfect word. Thanks!
- herge 11y ago
  > all tasks are top priority I often joke with my boss that if all tasks are high priority, all tasks are therefore of average priority.
frou_dh 11y ago
> Teaching blind compliance with any (unauthenticated) request based on "security" This feels especially strange on the phone, when someone (who later turns out to be legitimate) opens up the conversation by insisting that I prove who I am, _when they're the one that called me!_
- oarsinsync 11y ago
  Doubly so when they get irritated with you for responding with "and how do I know you are who you say you are?"
knodi123 11y ago
Tell me about it. Got an email from my bank yesterday, "You have an urgent notification waiting on our website! We won't tell you anything about it via email for security reasons!" So I log into the bank, go to the notifications section, "Notification! You have a new IMPORTANT document." Click on documents: "Here's the monthly statement for your savings account." Thanks guys. I hope you never need to contact me about something urgent.

HCIdivision17 11y ago

It's a pretty big deal. When everything starts at urgent and gets worse from there, people will just rescale the noise to be more understandable. It's just like the joke about sitting down and assigning points to a task and finding out everything is 100 or all bugs are critical or all tasks are top priority. The meta joke here is that is some ways every security issue is critical, but if everyone is immune to the fear then escalation will feel like the only choice. Either you slowly discharge that stress immunity by being sensibly mellow, or you start packing heat to 'convince' everyone to reboot NOW. (There's probably room for some amount of finesse between these two extremes.) EDIT: There's two terrible responses that seem to come out of this. Either no one gives a damn, or no one gives a damn and just does whatever you say. The first is bad because nothing gets fixed, and the second is bad for `red_admiral's reasons (users treat anything that looks like a security rant as a EULA and just do whatever it says).

acveilleux 11y ago
> When everything starts at urgent and gets worse from there, people will just rescale the noise to be more understandable. I really like that phrasing. I've been intuitively thinking along the same line but rescale is just the perfect word. Thanks!
herge 11y ago
> all tasks are top priority I often joke with my boss that if all tasks are high priority, all tasks are therefore of average priority.

frou_dh 11y ago

> Teaching blind compliance with any (unauthenticated) request based on "security" This feels especially strange on the phone, when someone (who later turns out to be legitimate) opens up the conversation by insisting that I prove who I am, _when they're the one that called me!_

oarsinsync 11y ago
Doubly so when they get irritated with you for responding with "and how do I know you are who you say you are?"

knodi123 11y ago

Tell me about it. Got an email from my bank yesterday, "You have an urgent notification waiting on our website! We won't tell you anything about it via email for security reasons!" So I log into the bank, go to the notifications section, "Notification! You have a new IMPORTANT document." Click on documents: "Here's the monthly statement for your savings account." Thanks guys. I hope you never need to contact me about something urgent.