16 ms·

‘Security Fatigue’ Can Cause Computer Users to Feel Hopeless and Act Recklessly

213 points by molecule 10y ago

colordrops 10y ago
"Security Fatigue", or just plain old drowning? I'm a software engineer and I feel like it's impossible to completely secure my hardware. It's a full time professional job to secure a computer, and at some point you just give up and do the best you can, knowing there are probably several holes in your security you aren't even aware of.
- leereeves 10y ago
  Countless computers secured by full time professionals have been hacked. The safest course is to assume that if it's connected to the Internet, it's not secure.
  - robbrown451 10y ago
    That may be safe, but seems impractical. I mean, I use email. It would be very, very bad if someone got into my email and started vandalizing my life. I might never know why I was losing friends, or worse. Secure vs. not secure is not a black and white thing.
    - hashkb 10y ago
      You should get real about how secure your email is, then. Are you using end to end encryption?
      - robbrown451 10y ago
        I use gmail with default settings. This isn't some situation that is unique to me. Most anyone could have their life messed up badly if someone got on their email and wanted to do them harm.
        anf 10y ago
        In other words "not end-to-end, but encrypted on all hops for most messages". Is there any evidence of email being intercepted by anyone who would wish to do anyone harm that isn't a public adversary of western intelligence?
      - fludlight 10y ago
        Encryption won't help you when someone installs a key logger on your endpoint.
      - justinlardinois 10y ago
        As in using PGP or something?
  - ythl 10y ago
    > Countless computers secured by full time professionals have been hacked. And yet, the black hats who breach such systems often have an attitude like "Wow, such a reputable organization has such sorry security. They deserve what I did to them". Computer security is a black hole that will consume ever increasing amounts of money, memory, and cpu cycles, forever. What a waste.
    - anf 10y ago
      > Computer security is a black hole that will consume ever increasing amounts of money, memory, and cpu cycles, forever. What a waste. That is defeatist and false. Computer security done intelligently can raise the cost of an attack above the value of what is being protected.
      - cmdrfred 10y ago
        I agree, a well spent security dollar might make an attack cost $100 more for the assailant. It's classic attrition warfare[0]. [0]https://en.wikipedia.org/wiki/Attrition_warfare https://en.wikipedia.org/wiki/Attrition_warfare
      - Spooky23 10y ago
        No way. Computer security is like a tax whose returns diminish rapidly. Once you start prioritizing it with money on security vs product/system engineering, security starts turning into a money monster that delivers nothing. I've seen it happen time and time again. The asymmetric nature of raising the cost for an attacker is a red herring. You can pat yourself on the back that you've supposedly made it 100x more expensive to attack you, but one operational fuckup pops that fantasy bubble at any time.
        dom0 10y ago
        I have to agree here. Security in itself is highly asymmetrical, because any single flaw can prove fatal, even with the latest and greatest defense-in-depth techniques. Not to forget the many, many instances where security systems actively harmed / enabled attacks.
  - raesene9 10y ago
    I don't find thinking of "secure" in an absolute sense really helpful. It all depends on your threat model, so who's going to attack you and what vectors and resources they'll have at their disposal. Sure against nation state level attackers it's fair to say that no-one but the most well funded of groups will be able to entirely avoid compromise, but it's definitely possible to avoid most of the lower end attacks that are more realistically a likelihood for most Internet users.
- raesene9 10y ago
  that's one of the reasons a lot of security people these days will recommend not just relying on preventative controls, but also detection and response. The assumption that nothing is 100% secure shouldn't lead to people just giving up , but hopefully lead to them spending effort on detecting attempted and successful intrusions and in having effective responses to them.
  - jacquesm 10y ago
    > that's one of the reasons a lot of security people these days will recommend not just relying on preventative controls, but also detection and response. Unfortunately, the parties that need this most are the least likely to implement it. The usual response to a question whether or not intrusion detection or exfiltration dectection / prevention measures are installed is 'What?', which I find a much more scary answer than 'No.'.
    - raesene9 10y ago
      oh absolutely, there's a bad problem in security where people don't want to admit there might be a chance their controls aren't perfect, and by deploying better detect/react controls you are very much admitting that point. So there's a tendency to downplay those requirements (what OS or application vendor is going to say "hey you should deploy something for when our security fails on you")
- wodencafe 10y ago
  Well at this point we're battling several different entities: Domestic Government Agencies, Foreign Government Agencies, various "Secretive Hacking Groups", Hacktivists, Malware, The Prince of Nigeria and other assorted phishing scams, our own Hardware Manufacturers (I'm looking at you, Intel and AMD), people within the network who are careless about their own security and have access to your data, not to mention the usual hits from China and the Middle East. Irony: Every government wants to authorize hacking at the state level, but nobody is rushing to secure their own infrastructure from being hacked.
tetrep 10y ago
It's unfortunate that "good UX" isn't really considered across all fields which have users. The recommendations to mitigate security fatigue are no different than any sort of user frustration: 1. Limit the number of ~~security~~ decisions users need to make; 2. Make it simple for users to choose the right ~~security~~ action; and 3. Design for consistent decision making whenever possible.
- ethbro 10y ago
  #2 is part of the problem. Users typically aren't informed enough to know the right action. I think that's one of the reasons we are in the current mess we're in. Attempting to explain the situation in plane, simple language is a better approach in my opinion.
  - magila 10y ago
    I'm not sure you could come up with language plain or simple enough, if for no other reason than because most people will not read it regardless.
ocdtrekkie 10y ago
One of the worst ones is those malicious "your computer has been infected" ads, that web browsers allow to disable to close tab buttons with message box windows and such. Users get frustrated, and give up and call the phone number, pay the $250, etc. It's very hard for me to convince people that: A. More than likely anything you do before you call me, is going to make it worse. B. You can always just shut off your PC.
- mjevans 10y ago
  This is one of the many reasons that script blockers (which are another opportunity for security fatigue) are something I frequently recommend friends, relatives, and co-workers use.
  - ocdtrekkie 10y ago
    I believe this is a poor solution, because the problem is simply with web browser design. Website-initiated popups should remain inside the browser tab, and the browser tab should always be closable. There is NO excuse for a web browser to allow a website to, even temporarily, disable it's UI, particularly the UI to close it. Scripting that controls your browser should not be allowed. Nontechnical users need to be able to trust their browser UI. Message boxes that look like OS prompts should simply not be available options for websites to use.
    - stephengillie 10y ago
      What about full screen video?
      - serge2k 10y ago
        They explicitly ask for permission for that and you can press escape at any time to leave. Seems reasonable.
        ocdtrekkie 10y ago
jungletek 10y ago
It's not security fatigue, it's just old-fashioned laziness combined with ignorance, compounded by the "on-a-computer" rationale that makes 'normal' people turn their brain off because they treat this box like it's black magic rather than trying to understand it. That they 'have' to use this box for work or recreation, rather than having a curiosity that fuels learning and exploration and therefore better understanding, leads to them feeling like they're at the mercy of the machine, rather than the master of it.
- ffggvv 10y ago
  You can't be passionate about everything.
- ivraatiems 10y ago
  I think this is a mischaracterization. I'm a software developer for a living and for fun, too, and I get tired of dealing with endless parades of security breaches and new best practices and so on. Even motivated, curious people can get fatigued, bored or annoyed.
- geofft 10y ago
  It's extremely ironic for an invective against laziness and ignorance to take the form of ignoring scientific research. If you really believed in curiosity and learning, you'd explain why you think the study is wrong.
- mordechai9000 10y ago
  I am mystified that people have so much trouble grasping basic computer concepts. But from the users' perspective, technologists have foisted a system on them that seems to be poorly made and requires a high level of expertise to use safely. Blaming the user when they are victimized by someone taking advantage of a shoddy system is, well, victim blaming.
  - blacksmith_tb 10y ago
    It's analogous to people understanding how their cars work. Many people are capable drivers but have no idea at all about what goes on in the engine, transmission, etc. Would understanding those improve their driving? Potentially (especially in cases where they fail), but clearly it isn't a requirement. But like you say, the bar seems to be higher for computing.
mtgx 10y ago
This seems to be mostly about "having to remember too many passwords": > “Years ago, you had one password to keep up with at work,” she said. “Now people are being asked to remember 25 or 30. We haven’t really thought about cybersecurity expanding and what it has done to people.” So why not switch to using password managers and hardware tokens then?
- stevarino 10y ago
  Switching to a password manager has increased my security more than any other decision I've made, not to mention the convenience of having a secure place to store them. I recommend them to everyone I can but still people are afraid.
- abhorrence 10y ago
  Most people I've talked to who aren't "into computers" think they're too complicated, and don't really understand how they work. Plus they don't feel they know enough to assess whether or not they're a good idea.
  - marcosdumay 10y ago
    The last one is easy. You just tell them it's a very good idea. And while you are at it, tell them to use a long passphrase as a master password, ignoring upper case, numbers and special characters.
    - abhorrence 10y ago
      You would think it should be easy, but I've found that people have worked themselves up into a frenzy about how not-understanding of computers they are to the point where they won't even try to understand. :/
- geofft 10y ago
  Because between years ago and now, security experts convinced us that you should never write down passwords or store them anywhere.
patmcguire 10y ago
Yeah, I definitely reuse passwords for things, and not always strong ones. I do have a certain nihilistic resignation about the whole thing: sure, I can turn on two factor auth with a different automatically generated GUID password I keep in a password manager, but anyone can open up a line of credit anywhere in the country under my name if they know one 9 digit number that isn't really secret and can never be changed. What's the point?
- raesene9 10y ago
  For me the point lies in avoiding the hassle of getting a notification from haveibeenpwned.com that one of my accounts has been compromised and having to worry where else I used that username/password combo. That's why I user a password safe so that when that happens (at least 4 times to date), I can just shrug my shoulders and move on, resetting just that one password if I still use the site.
ben_jones 10y ago
Have end users felt major repercussions from any of the large hacks that have happened in the last five years? I feel like it actually induces positive feedback, at least from some consumer companies. For example sony got hacked and users got (2?) free games. The government got hacked and users got free credit monitoring. I understand such hacks fuel credit card fraud and identity theft, but at least in my small non-tech circle this has been a nonfactor.
Area12 10y ago
From an old IT guy, none of this is new ... Scott Adams (of Dilbert) noted it in 1998: http://dilbert.com/strip/1998-04-06 http://dilbert.com/strip/1998-04-06 That was 18 years ago. Particularly raw for Dilbert: "Squeal like a pig" is from the 1972 movie "Deliverance" and refers to a assault that was one of the most disturbing US mainstream movie scenes of the 1970s. The only real improvement in all that time that I can think of: password managers. I almost said Single Sign On, but that comes with its own security issues.
- nutjob123 10y ago
  Two factor authentication is a major improvement. Combined with a password manager is a pretty good combination.
  - tajen 10y ago
    > Combined with a password manager is a pretty good combination. So 2FA combines something you have (your phone) with something your phone knows.
    - crpatino 10y ago
      not if you access the site from a laptop/desktop
    - rahkiin 10y ago
      Exactly! And I use 1Password so I also have the tokens on my computer, together with my passwords. Replay attacks get harder though.
      - justinlardinois 10y ago
        I think his point was that if your password is stored on your phone, two factor authentication doesn't actually add any security because it's no longer two factor.
    - deleted 10y ago
      [deleted]
GigabyteCoin 10y ago
>Security fatigue is defined in the study as a weariness or reluctance to deal with computer security. Can that even be defined if it completely overlaps the umbrella of "people who use computers but are not IT professionals". One of my friend's passwords for everything is expl0r3r and has been for years because his family drove a ford explorer when he was younger. Another buddy's password for everything is "Duncan" ... because his dog is named duncan. Pretty much everybody else I know has their password literally stickied to the side of their monitor or sitting on their desk somewhere. Can "Security Fatigue" really be a thing if the entire world is subject to it?
- raesene9 10y ago
  I'd say it can. the modern world is forcing people to make more and more use of computer systems to effectively operate in society. Governments and corporations are moving processes online (generally 'cause it's cost effective for them to do so). It's very unfortunate that in a kind of tragedy of the commons, each site owner just rolls out the easiest authentication options available (username/password) and then leaves the user, who's rarely equipped to handle it, to deal with the fallout of having huge numbers of logins to manage.
- anf 10y ago
  It happens to IT professionals, as well. "Shit, I just gotta get this done, let's do it like this and re-evaluate later". Look at the $10k bounties on hackerone.com -- many bugs are clearly from people who are not operating at their best.
robbrown451 10y ago
I think one of the worst things is the sites that think they are being "more secure" by adding extra rules for passwords beyond the typical. If people want to use the same password for everything -- or maybe better, use one password for the really important stuff and another password for everything else -- you really shouldn't try to fight against that be requiring at least one capital letter and at least one number and at least one symbol (or whatever). Another obnoxious thing is sites that, when you change your password, don't let you use one you've used in the last X months. In both these cases, what happens is that you defeat people's attempts to make their passwords adhere to some system they can remember. And then they just says "f*ck it" and do really easy to guess passwords.
- raesene9 10y ago
  Luckily we've started to see more sane advice on passwords come out from reputable organisations which contradicts some of the security cargo cults that you mention. Specifically there's a good doc. from CESG in the UK https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/458857/Password_guidance_-_simplifying_your_approach.pdf https://www.gov.uk/government/uploads/system/uploads/attachm... which has a far more realistic approach to good password security.
- jkaptur 10y ago
  In some of these cases, I suspect that the "password recovery" process is doing double duty as the primary login flow for many users.
  - kristofferR 10y ago
    Yeah, it's weird that offering users the choice of "login by clicking the link we just emailed you" isn't more common.
    - Pxtl 10y ago
      Exactly. I want an extra button next to the login form for "login by email". Send me an email that contains the geolocation and IP address of the requester and login link (that also logs in the requester browser session so I can auth from my phone even if I'm browsing on pc) as well as a "reject" link that they can use to determine if this is malicious.
raesene9 10y ago
I'm not really surprised to see this at all. The probem of non-technical users being asked to operate systems in what is a very hostile environment (The Internet) has been evident for a while. My prediction is that this will lead to even more of a rise of walled garden style ecosystems, where this problem is at least partially managed for the user by the owner of the ecosystem. So for example if I use iOS apps for everything I can let them handle authentication for me and use my fingerprint, which is a much much nicer user experience than remembering a load of passwords. Of course that's not great for the open web, but this very much feels like a tragedy of the commons to me, everyone knows better security is needed, but no-one wants to be the body leading the charge as it's a really hard problem to solve.
- PhantomGremlin 10y ago
  So for example if I use iOS apps for everything I can let them handle authentication for me and use my fingerprint, which is a much much nicer user experience than remembering a load of passwords. I'm two-thirds of the way thru the comments here, and you are the first to mention this. And yet, as you say, it's a "much much" nicer experience. I've started allowing iOS apps to identify me by fingerprint, and it's a lot more pleasant to do that than to type in some crazy long password.
  - _Understated_ 10y ago
    But the problem with using your fingerprint as your "password" in this case is that if your fingerprint becomes compromised you are royally fucked: You can't ever change it! Fingerprints should be usernames, not passwords.
raarts 10y ago
1password almost completely solved this problem for me. Something like it should become part of the OS. Although I wish the agilebits people all the best...
- filoeleven 10y ago
  Apple's iCloud Keychain has this built-in. Of course, it only works in Safari, and you have to use iCloud...
  - kalleboo 10y ago
    On the Mac, third-party apps also have access to the Keychain (not just Safari). On iOS, each developer only has their own keychain.
sumitgt 10y ago
Looks like most of the problems these users have can easily be solved by using something like Lastpass. I personally feel like people who are tech-savvy should encourage and teach everyone else to use password managers.
- Gruselbauer 10y ago
  LastPass + 2FA here. I remember one diceware-style master password, the device creating the 2FA tokens has never even entered it, much less the app for LP. 16-100 character randomised alphanumeric+special passwords for every account, no need to remember a single one. Their browser extension is really good, too. Oh and the passphrases for my PGP and SSH keys. Also stored in my LP vault. Can I be bothered to care more than that? Nope.
abalone 10y ago
This is why Touch ID & iCloud Keychain are such important advancements. It's not enough to make it possible to securely manage passwords. You also have to make it easy.
shp0ngle 10y ago
I don't have a security fatigue, but I sure have 'privacy fatigue'. I should worry about Google knowing this and that about me, I should worry about the stupid retargeting and the fact that if I do something online, it follows me through the web with banners and "youtube recommendations". And that everything is saved and googlable and everyone can know everything about me. And I used to be worried, but now, I gave up. The assault of the security sucking companies is too high - Facebook and Google has the best engineers and everyone loves their open source code - and it's just way too convenient. Sorry for unrelated ranting.
- Balgair 10y ago
  No, it is ok. I think we all feel this way. Most HN readers are familiar with many of the 'leaks' and various 1984-esque things happening in our world. I'd say a lot of us are uncomfortable around the Amazon Alexa devices, let alone the actual govtech face readers. I'm not saying that there is anything to be/not to be 'done' about it. I'm just saying that you are not alone in this feeling.
- mastazi 10y ago
  > I don't have a security fatigue, but I sure have 'privacy fatigue'. Exactly, it would be good if there was some relevant research about the how perception of privacy issues influences users behaviour, in relation to businesses (e.g. Google, Facebook) and state actors (governments). The linked article explains that security fatigue has a cost on the economy; maybe if there was a similar conclusion about "privacy fatigue", that could lead to a healthy debate and, ultimately, (I know, I'm dreaming here) better privacy laws.
- walterbell 10y ago
  Some people have not given up. Home broadband now exceeds yesteryear expensive symmetric T1 lines. Cheap virtualization-capable small server hardware (Dell T20, Lenovo TS140) + free hypervisors allow self-hosting of OSS services which can replace/supplement commercial vendors and perform network filtering and DPI/IDS to reduce tracking. A pfSense VPN VM can make self-hosted services and filtering available to mobile devices and laptops. After turning off iCloud and other settings, iOS is reasonably respectful of user policy and informed consent. A one-time admin cost per year (iOS major version lifetime).
dkfmn 10y ago
For the love of all that's holy, my local pizza shop does NOT need a secure password. They don't even store my credit card. I honestly do not care if someone logs in and see's my favorite order.
- deleted 10y ago
  [deleted]
tpeo 10y ago
The phrase "security fatigue" makes me raise an eyebrow. Are these guys implying I should keep track of twenty or thirty passwords, but I just can't keep up? Frankly, if it's not something I use everyday and care about, I can't be bothered to put a strong password in it.
awongh 10y ago
Is it possible that a startup could come into this space and solve some of this problem? Something between all your passwords are belong to us walled garden touch id scheme and tin foil hat must memorize new 20 char randomized password every 10 months setup.... It seems that answers to this problem fall into one extreme or the other, but I would personally use a solution somewhere between the two that gave me peace of mind and was convenient at the same time. This would probably be a password manager type thing / cloud solution? Maybe open source? Some things I'd like to see: - secure passwords where appropriate: do I need my pinterest account to be super secure? - 2 factor auth where appropriate: protect my bank accounts, etc. - tell me when there's been a breach and prompt me to change my password- who can keep track of all the times I need to change my password? - let me have a rememberable password sometimes- sometimes I need to log into something not on my personal phone / computer etc. - don't let the nsa spy on me/ my cloud account / make it harder than normal - maybe integrate with keyfobs / security hardware where appropriate thats some stuff of the top of my head but there are so many little catches in dealing with passwords that I would be happy to pay for a product that helped me manage it in the right way. I wonder if there are others out there that fall into this same middle ground of, secure, private, good-enough?
- TheDrizzle43 10y ago
  There's already a few popular services that do password management i.e. LastPass & 1password. Unless you are describing something different?
zerognowl 10y ago
Qubes + Whonix + Store-bought Thinkpad with the motherboard/circuitry xrayed and diffed with other 'clean' / non-tampered Thinkpads = Win Bonus points for: - Basic internet hygiene. Clear that history! - Compartmentalization. Don't put all your eggs in one basket! - Low footprint. Don't stand out in the crowd! - Avoid prismware like Windows at all costs! - Blanket encrypt everything no matter how non controversial it is! - Throw out your smartphone! Buy all the old Nokias! - Don't order laptops from Amazon!
- qntty 10y ago
  can't tell if this is satire or not
  - zerognowl 10y ago
    I told my friend they should use a secure setup like this, and I was laughed at. It might sound like satire, but those are baseline procedures for working with the web now. As soon as you connect a computer to the Public Internet it instantly becomes a target, and needs to be hardened as such.
0xcde4c3db 10y ago
The silly password rules aren't great, but on the whole I think of the issue more as "account fatigue" (which is sort of mentioned in the opening paragraph and then largely ignored). At work alone, I have: 1) A Windows domain account 2) A GitHub account 3/4) Accounts for two separate project management web apps 5) An account for our own web app 6) An account for the payroll web app 7) An account for the HR performance appraisal web app 8) An account to register for on-site flu shots 9) An account on a project development VM 10) An account for the outsourced IT security training And probably a few more that I forgot because I'm not in front of my password manager right now. It also doesn't help that we have a narrative around "identity theft" that puts virtually all of the burden of a leak on the account holder, even in cases where it was unequivocally the company's security that failed.
sslmann2199 10y ago
Past

213 points by molecule 10y ago

"Security Fatigue", or just plain old drowning? I'm a software engineer and I feel like it's impossible to completely secure my hardware. It's a full time professional job to secure a computer, and at some point you just give up and do the best you can, knowing there are probably several holes in your security you aren't even aware of.

leereeves 10y ago
Countless computers secured by full time professionals have been hacked. The safest course is to assume that if it's connected to the Internet, it's not secure.
- robbrown451 10y ago
  That may be safe, but seems impractical. I mean, I use email. It would be very, very bad if someone got into my email and started vandalizing my life. I might never know why I was losing friends, or worse. Secure vs. not secure is not a black and white thing.
  - hashkb 10y ago
    You should get real about how secure your email is, then. Are you using end to end encryption?
    - robbrown451 10y ago
      I use gmail with default settings. This isn't some situation that is unique to me. Most anyone could have their life messed up badly if someone got on their email and wanted to do them harm.
      - anf 10y ago
        In other words "not end-to-end, but encrypted on all hops for most messages". Is there any evidence of email being intercepted by anyone who would wish to do anyone harm that isn't a public adversary of western intelligence?
    - fludlight 10y ago
      Encryption won't help you when someone installs a key logger on your endpoint.
    - justinlardinois 10y ago
      As in using PGP or something?
- ythl 10y ago
  > Countless computers secured by full time professionals have been hacked. And yet, the black hats who breach such systems often have an attitude like "Wow, such a reputable organization has such sorry security. They deserve what I did to them". Computer security is a black hole that will consume ever increasing amounts of money, memory, and cpu cycles, forever. What a waste.
  - anf 10y ago
    > Computer security is a black hole that will consume ever increasing amounts of money, memory, and cpu cycles, forever. What a waste. That is defeatist and false. Computer security done intelligently can raise the cost of an attack above the value of what is being protected.
    - cmdrfred 10y ago
      I agree, a well spent security dollar might make an attack cost $100 more for the assailant. It's classic attrition warfare[0]. [0]https://en.wikipedia.org/wiki/Attrition_warfare https://en.wikipedia.org/wiki/Attrition_warfare
    - Spooky23 10y ago
      No way. Computer security is like a tax whose returns diminish rapidly. Once you start prioritizing it with money on security vs product/system engineering, security starts turning into a money monster that delivers nothing. I've seen it happen time and time again. The asymmetric nature of raising the cost for an attacker is a red herring. You can pat yourself on the back that you've supposedly made it 100x more expensive to attack you, but one operational fuckup pops that fantasy bubble at any time.
      - dom0 10y ago
        I have to agree here. Security in itself is highly asymmetrical, because any single flaw can prove fatal, even with the latest and greatest defense-in-depth techniques. Not to forget the many, many instances where security systems actively harmed / enabled attacks.
- raesene9 10y ago
  I don't find thinking of "secure" in an absolute sense really helpful. It all depends on your threat model, so who's going to attack you and what vectors and resources they'll have at their disposal. Sure against nation state level attackers it's fair to say that no-one but the most well funded of groups will be able to entirely avoid compromise, but it's definitely possible to avoid most of the lower end attacks that are more realistically a likelihood for most Internet users.
raesene9 10y ago
that's one of the reasons a lot of security people these days will recommend not just relying on preventative controls, but also detection and response. The assumption that nothing is 100% secure shouldn't lead to people just giving up , but hopefully lead to them spending effort on detecting attempted and successful intrusions and in having effective responses to them.
- jacquesm 10y ago
  > that's one of the reasons a lot of security people these days will recommend not just relying on preventative controls, but also detection and response. Unfortunately, the parties that need this most are the least likely to implement it. The usual response to a question whether or not intrusion detection or exfiltration dectection / prevention measures are installed is 'What?', which I find a much more scary answer than 'No.'.
  - raesene9 10y ago
    oh absolutely, there's a bad problem in security where people don't want to admit there might be a chance their controls aren't perfect, and by deploying better detect/react controls you are very much admitting that point. So there's a tendency to downplay those requirements (what OS or application vendor is going to say "hey you should deploy something for when our security fails on you")
wodencafe 10y ago
Well at this point we're battling several different entities: Domestic Government Agencies, Foreign Government Agencies, various "Secretive Hacking Groups", Hacktivists, Malware, The Prince of Nigeria and other assorted phishing scams, our own Hardware Manufacturers (I'm looking at you, Intel and AMD), people within the network who are careless about their own security and have access to your data, not to mention the usual hits from China and the Middle East. Irony: Every government wants to authorize hacking at the state level, but nobody is rushing to secure their own infrastructure from being hacked.

tetrep 10y ago

It's unfortunate that "good UX" isn't really considered across all fields which have users. The recommendations to mitigate security fatigue are no different than any sort of user frustration: 1. Limit the number of ~~security~~ decisions users need to make; 2. Make it simple for users to choose the right ~~security~~ action; and 3. Design for consistent decision making whenever possible.

ethbro 10y ago
#2 is part of the problem. Users typically aren't informed enough to know the right action. I think that's one of the reasons we are in the current mess we're in. Attempting to explain the situation in plane, simple language is a better approach in my opinion.
- magila 10y ago
  I'm not sure you could come up with language plain or simple enough, if for no other reason than because most people will not read it regardless.

ocdtrekkie 10y ago

One of the worst ones is those malicious "your computer has been infected" ads, that web browsers allow to disable to close tab buttons with message box windows and such. Users get frustrated, and give up and call the phone number, pay the $250, etc. It's very hard for me to convince people that: A. More than likely anything you do before you call me, is going to make it worse. B. You can always just shut off your PC.

mjevans 10y ago
This is one of the many reasons that script blockers (which are another opportunity for security fatigue) are something I frequently recommend friends, relatives, and co-workers use.
- ocdtrekkie 10y ago
  I believe this is a poor solution, because the problem is simply with web browser design. Website-initiated popups should remain inside the browser tab, and the browser tab should always be closable. There is NO excuse for a web browser to allow a website to, even temporarily, disable it's UI, particularly the UI to close it. Scripting that controls your browser should not be allowed. Nontechnical users need to be able to trust their browser UI. Message boxes that look like OS prompts should simply not be available options for websites to use.
  - stephengillie 10y ago
    What about full screen video?
    - serge2k 10y ago
      They explicitly ask for permission for that and you can press escape at any time to leave. Seems reasonable.
      - ocdtrekkie 10y ago

jungletek 10y ago

It's not security fatigue, it's just old-fashioned laziness combined with ignorance, compounded by the "on-a-computer" rationale that makes 'normal' people turn their brain off because they treat this box like it's black magic rather than trying to understand it. That they 'have' to use this box for work or recreation, rather than having a curiosity that fuels learning and exploration and therefore better understanding, leads to them feeling like they're at the mercy of the machine, rather than the master of it.

ffggvv 10y ago
You can't be passionate about everything.
ivraatiems 10y ago
I think this is a mischaracterization. I'm a software developer for a living and for fun, too, and I get tired of dealing with endless parades of security breaches and new best practices and so on. Even motivated, curious people can get fatigued, bored or annoyed.
geofft 10y ago
It's extremely ironic for an invective against laziness and ignorance to take the form of ignoring scientific research. If you really believed in curiosity and learning, you'd explain why you think the study is wrong.
mordechai9000 10y ago
I am mystified that people have so much trouble grasping basic computer concepts. But from the users' perspective, technologists have foisted a system on them that seems to be poorly made and requires a high level of expertise to use safely. Blaming the user when they are victimized by someone taking advantage of a shoddy system is, well, victim blaming.
- blacksmith_tb 10y ago
  It's analogous to people understanding how their cars work. Many people are capable drivers but have no idea at all about what goes on in the engine, transmission, etc. Would understanding those improve their driving? Potentially (especially in cases where they fail), but clearly it isn't a requirement. But like you say, the bar seems to be higher for computing.

mtgx 10y ago

This seems to be mostly about "having to remember too many passwords": > “Years ago, you had one password to keep up with at work,” she said. “Now people are being asked to remember 25 or 30. We haven’t really thought about cybersecurity expanding and what it has done to people.” So why not switch to using password managers and hardware tokens then?

stevarino 10y ago
Switching to a password manager has increased my security more than any other decision I've made, not to mention the convenience of having a secure place to store them. I recommend them to everyone I can but still people are afraid.
abhorrence 10y ago
Most people I've talked to who aren't "into computers" think they're too complicated, and don't really understand how they work. Plus they don't feel they know enough to assess whether or not they're a good idea.
- marcosdumay 10y ago
  The last one is easy. You just tell them it's a very good idea. And while you are at it, tell them to use a long passphrase as a master password, ignoring upper case, numbers and special characters.
  - abhorrence 10y ago
    You would think it should be easy, but I've found that people have worked themselves up into a frenzy about how not-understanding of computers they are to the point where they won't even try to understand. :/
geofft 10y ago
Because between years ago and now, security experts convinced us that you should never write down passwords or store them anywhere.

patmcguire 10y ago

Yeah, I definitely reuse passwords for things, and not always strong ones. I do have a certain nihilistic resignation about the whole thing: sure, I can turn on two factor auth with a different automatically generated GUID password I keep in a password manager, but anyone can open up a line of credit anywhere in the country under my name if they know one 9 digit number that isn't really secret and can never be changed. What's the point?

raesene9 10y ago
For me the point lies in avoiding the hassle of getting a notification from haveibeenpwned.com that one of my accounts has been compromised and having to worry where else I used that username/password combo. That's why I user a password safe so that when that happens (at least 4 times to date), I can just shrug my shoulders and move on, resetting just that one password if I still use the site.

ben_jones 10y ago

Have end users felt major repercussions from any of the large hacks that have happened in the last five years? I feel like it actually induces positive feedback, at least from some consumer companies. For example sony got hacked and users got (2?) free games. The government got hacked and users got free credit monitoring. I understand such hacks fuel credit card fraud and identity theft, but at least in my small non-tech circle this has been a nonfactor.

Area12 10y ago

From an old IT guy, none of this is new ... Scott Adams (of Dilbert) noted it in 1998: http://dilbert.com/strip/1998-04-06 http://dilbert.com/strip/1998-04-06 That was 18 years ago. Particularly raw for Dilbert: "Squeal like a pig" is from the 1972 movie "Deliverance" and refers to a assault that was one of the most disturbing US mainstream movie scenes of the 1970s. The only real improvement in all that time that I can think of: password managers. I almost said Single Sign On, but that comes with its own security issues.

nutjob123 10y ago
Two factor authentication is a major improvement. Combined with a password manager is a pretty good combination.
- tajen 10y ago
  > Combined with a password manager is a pretty good combination. So 2FA combines something you have (your phone) with something your phone knows.
  - crpatino 10y ago
    not if you access the site from a laptop/desktop
  - rahkiin 10y ago
    Exactly! And I use 1Password so I also have the tokens on my computer, together with my passwords. Replay attacks get harder though.
    - justinlardinois 10y ago
      I think his point was that if your password is stored on your phone, two factor authentication doesn't actually add any security because it's no longer two factor.
  - deleted 10y ago
    [deleted]

GigabyteCoin 10y ago

>Security fatigue is defined in the study as a weariness or reluctance to deal with computer security. Can that even be defined if it completely overlaps the umbrella of "people who use computers but are not IT professionals". One of my friend's passwords for everything is expl0r3r and has been for years because his family drove a ford explorer when he was younger. Another buddy's password for everything is "Duncan" ... because his dog is named duncan. Pretty much everybody else I know has their password literally stickied to the side of their monitor or sitting on their desk somewhere. Can "Security Fatigue" really be a thing if the entire world is subject to it?

raesene9 10y ago
I'd say it can. the modern world is forcing people to make more and more use of computer systems to effectively operate in society. Governments and corporations are moving processes online (generally 'cause it's cost effective for them to do so). It's very unfortunate that in a kind of tragedy of the commons, each site owner just rolls out the easiest authentication options available (username/password) and then leaves the user, who's rarely equipped to handle it, to deal with the fallout of having huge numbers of logins to manage.
anf 10y ago
It happens to IT professionals, as well. "Shit, I just gotta get this done, let's do it like this and re-evaluate later". Look at the $10k bounties on hackerone.com -- many bugs are clearly from people who are not operating at their best.

robbrown451 10y ago

I think one of the worst things is the sites that think they are being "more secure" by adding extra rules for passwords beyond the typical. If people want to use the same password for everything -- or maybe better, use one password for the really important stuff and another password for everything else -- you really shouldn't try to fight against that be requiring at least one capital letter and at least one number and at least one symbol (or whatever). Another obnoxious thing is sites that, when you change your password, don't let you use one you've used in the last X months. In both these cases, what happens is that you defeat people's attempts to make their passwords adhere to some system they can remember. And then they just says "f*ck it" and do really easy to guess passwords.

raesene9 10y ago
Luckily we've started to see more sane advice on passwords come out from reputable organisations which contradicts some of the security cargo cults that you mention. Specifically there's a good doc. from CESG in the UK https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/458857/Password_guidance_-_simplifying_your_approach.pdf https://www.gov.uk/government/uploads/system/uploads/attachm... which has a far more realistic approach to good password security.
jkaptur 10y ago
In some of these cases, I suspect that the "password recovery" process is doing double duty as the primary login flow for many users.
- kristofferR 10y ago
  Yeah, it's weird that offering users the choice of "login by clicking the link we just emailed you" isn't more common.
  - Pxtl 10y ago
    Exactly. I want an extra button next to the login form for "login by email". Send me an email that contains the geolocation and IP address of the requester and login link (that also logs in the requester browser session so I can auth from my phone even if I'm browsing on pc) as well as a "reject" link that they can use to determine if this is malicious.

raesene9 10y ago

I'm not really surprised to see this at all. The probem of non-technical users being asked to operate systems in what is a very hostile environment (The Internet) has been evident for a while. My prediction is that this will lead to even more of a rise of walled garden style ecosystems, where this problem is at least partially managed for the user by the owner of the ecosystem. So for example if I use iOS apps for everything I can let them handle authentication for me and use my fingerprint, which is a much much nicer user experience than remembering a load of passwords. Of course that's not great for the open web, but this very much feels like a tragedy of the commons to me, everyone knows better security is needed, but no-one wants to be the body leading the charge as it's a really hard problem to solve.

PhantomGremlin 10y ago
So for example if I use iOS apps for everything I can let them handle authentication for me and use my fingerprint, which is a much much nicer user experience than remembering a load of passwords. I'm two-thirds of the way thru the comments here, and you are the first to mention this. And yet, as you say, it's a "much much" nicer experience. I've started allowing iOS apps to identify me by fingerprint, and it's a lot more pleasant to do that than to type in some crazy long password.
- _Understated_ 10y ago
  But the problem with using your fingerprint as your "password" in this case is that if your fingerprint becomes compromised you are royally fucked: You can't ever change it! Fingerprints should be usernames, not passwords.

raarts 10y ago

1password almost completely solved this problem for me. Something like it should become part of the OS. Although I wish the agilebits people all the best...

filoeleven 10y ago
Apple's iCloud Keychain has this built-in. Of course, it only works in Safari, and you have to use iCloud...
- kalleboo 10y ago
  On the Mac, third-party apps also have access to the Keychain (not just Safari). On iOS, each developer only has their own keychain.

sumitgt 10y ago

Looks like most of the problems these users have can easily be solved by using something like Lastpass. I personally feel like people who are tech-savvy should encourage and teach everyone else to use password managers.

Gruselbauer 10y ago
LastPass + 2FA here. I remember one diceware-style master password, the device creating the 2FA tokens has never even entered it, much less the app for LP. 16-100 character randomised alphanumeric+special passwords for every account, no need to remember a single one. Their browser extension is really good, too. Oh and the passphrases for my PGP and SSH keys. Also stored in my LP vault. Can I be bothered to care more than that? Nope.

abalone 10y ago

This is why Touch ID & iCloud Keychain are such important advancements. It's not enough to make it possible to securely manage passwords. You also have to make it easy.

shp0ngle 10y ago

I don't have a security fatigue, but I sure have 'privacy fatigue'. I should worry about Google knowing this and that about me, I should worry about the stupid retargeting and the fact that if I do something online, it follows me through the web with banners and "youtube recommendations". And that everything is saved and googlable and everyone can know everything about me. And I used to be worried, but now, I gave up. The assault of the security sucking companies is too high - Facebook and Google has the best engineers and everyone loves their open source code - and it's just way too convenient. Sorry for unrelated ranting.

Balgair 10y ago
No, it is ok. I think we all feel this way. Most HN readers are familiar with many of the 'leaks' and various 1984-esque things happening in our world. I'd say a lot of us are uncomfortable around the Amazon Alexa devices, let alone the actual govtech face readers. I'm not saying that there is anything to be/not to be 'done' about it. I'm just saying that you are not alone in this feeling.
mastazi 10y ago
> I don't have a security fatigue, but I sure have 'privacy fatigue'. Exactly, it would be good if there was some relevant research about the how perception of privacy issues influences users behaviour, in relation to businesses (e.g. Google, Facebook) and state actors (governments). The linked article explains that security fatigue has a cost on the economy; maybe if there was a similar conclusion about "privacy fatigue", that could lead to a healthy debate and, ultimately, (I know, I'm dreaming here) better privacy laws.
walterbell 10y ago
Some people have not given up. Home broadband now exceeds yesteryear expensive symmetric T1 lines. Cheap virtualization-capable small server hardware (Dell T20, Lenovo TS140) + free hypervisors allow self-hosting of OSS services which can replace/supplement commercial vendors and perform network filtering and DPI/IDS to reduce tracking. A pfSense VPN VM can make self-hosted services and filtering available to mobile devices and laptops. After turning off iCloud and other settings, iOS is reasonably respectful of user policy and informed consent. A one-time admin cost per year (iOS major version lifetime).

dkfmn 10y ago

For the love of all that's holy, my local pizza shop does NOT need a secure password. They don't even store my credit card. I honestly do not care if someone logs in and see's my favorite order.

deleted 10y ago
[deleted]

tpeo 10y ago

The phrase "security fatigue" makes me raise an eyebrow. Are these guys implying I should keep track of twenty or thirty passwords, but I just can't keep up? Frankly, if it's not something I use everyday and care about, I can't be bothered to put a strong password in it.

awongh 10y ago

Is it possible that a startup could come into this space and solve some of this problem? Something between all your passwords are belong to us walled garden touch id scheme and tin foil hat must memorize new 20 char randomized password every 10 months setup.... It seems that answers to this problem fall into one extreme or the other, but I would personally use a solution somewhere between the two that gave me peace of mind and was convenient at the same time. This would probably be a password manager type thing / cloud solution? Maybe open source? Some things I'd like to see: - secure passwords where appropriate: do I need my pinterest account to be super secure? - 2 factor auth where appropriate: protect my bank accounts, etc. - tell me when there's been a breach and prompt me to change my password- who can keep track of all the times I need to change my password? - let me have a rememberable password sometimes- sometimes I need to log into something not on my personal phone / computer etc. - don't let the nsa spy on me/ my cloud account / make it harder than normal - maybe integrate with keyfobs / security hardware where appropriate thats some stuff of the top of my head but there are so many little catches in dealing with passwords that I would be happy to pay for a product that helped me manage it in the right way. I wonder if there are others out there that fall into this same middle ground of, secure, private, good-enough?

TheDrizzle43 10y ago
There's already a few popular services that do password management i.e. LastPass & 1password. Unless you are describing something different?

zerognowl 10y ago

Qubes + Whonix + Store-bought Thinkpad with the motherboard/circuitry xrayed and diffed with other 'clean' / non-tampered Thinkpads = Win Bonus points for: - Basic internet hygiene. Clear that history! - Compartmentalization. Don't put all your eggs in one basket! - Low footprint. Don't stand out in the crowd! - Avoid prismware like Windows at all costs! - Blanket encrypt everything no matter how non controversial it is! - Throw out your smartphone! Buy all the old Nokias! - Don't order laptops from Amazon!

qntty 10y ago
can't tell if this is satire or not
- zerognowl 10y ago
  I told my friend they should use a secure setup like this, and I was laughed at. It might sound like satire, but those are baseline procedures for working with the web now. As soon as you connect a computer to the Public Internet it instantly becomes a target, and needs to be hardened as such.

0xcde4c3db 10y ago

The silly password rules aren't great, but on the whole I think of the issue more as "account fatigue" (which is sort of mentioned in the opening paragraph and then largely ignored). At work alone, I have: 1) A Windows domain account 2) A GitHub account 3/4) Accounts for two separate project management web apps 5) An account for our own web app 6) An account for the payroll web app 7) An account for the HR performance appraisal web app 8) An account to register for on-site flu shots 9) An account on a project development VM 10) An account for the outsourced IT security training And probably a few more that I forgot because I'm not in front of my password manager right now. It also doesn't help that we have a narrative around "identity theft" that puts virtually all of the burden of a leak on the account holder, even in cases where it was unequivocally the company's security that failed.

sslmann2199 10y ago

Past