3 ms·

Most people, funnily enough, don't run background checks on other people, and don't have a well-formed mental model of why they're necessary and what the securi

Most people, funnily enough, don't run background checks on other people, and don't have a well-formed mental model of why they're necessary and what the security risks in using them are.

mehrdadn 9y ago
> Most people, funnily enough, don't run background checks on other people They don't do it because they're not employers/landlords/etc. and hence the need never arises, not because they somehow have a complete lack of understanding of the concept. > and don't have a well-formed mental model of why they're necessary and what the security risks in using them are They understand why they need to keep their bank passwords safe, and hence they can understand that they shouldn't enter it on someone else's website. They understand what a fake ID or passport is, and they understand why they shouldn't give their ID numbers to random strangers. The specific examples I used are not the point. I explicitly said they're not perfect; they're just there to get a bigger point across. Look at the larger point. The point is people are already dealing with much more complicated stuff on a daily basis. They understand the concept of lying. They understand that identity theft can wreak havoc on their lives. They understand how to prevent it. So they can handle the concept of what it means to enter their credentials on the wrong site. It's not technical and it's not complicated, and it's not necessary for them to understand how exactly doing the wrong thing might lead to an undesirable result. If you'd like to convince me that the average person can't understand this concept, at least support your claim by providing a link to a study or something that isn't based on a cherry-picked strawman version of what I've suggested? Surely someone's already looked into this kind of an approach and what you're saying isn't just pure speculation?
- icebraining 9y ago
  The issue is not whether they are capable of understanding it, it's that they don't currently, and browsers have to be designed with that fact in mind. Showing them a message like you suggested only works if they already understood it.
  - mehrdadn 9y ago
    > The issue is not whether they are capable of understanding it, it's that they don't currently, and browsers have to be designed with that fact in mind. Showing them a message like you suggested only works if they already understood it. But I'm only saying the current UX could become much better, not that they have to switch to my suggested UI by tomorrow. Of course spending some time on user education and transitioning gradually would be a great idea. I was never against that; I'm all for it. So why implicitly rule this out as an impossibility?
- vertex-four 9y ago
  > They understand why they need to keep their bank passwords safe, and hence they can understand that they shouldn't enter it on someone else's website. Not in my experience - people reuse passwords regularly, and are exceptionally vulnerable to phishing scams, as you should ask anybody working in corporate IT. This is why people actually working in security are very excited about U2F - a U2F-generated token is tied to a specific domain, so password reuse and phishing are both no longer as serious a problem, since a login to scammer.com no longer works as a login to mybank.com. On top of that, people give their bank passwords to e.g. mint.com on a regular basis, when it's specifically asking for their bank password and they have no reason to trust that website. > they understand why they shouldn't give their ID numbers to random strangers Also not in my experience, and the basis of many scams. People at large are terrible at security. We've been moving towards "automatic security" for a while for a reason. And that's before you get to the phenomena where critical thinking goes out the window as soon as something is on a computer instead of "in real life". > Surely someone's already looked into this kind of an approach and what you're saying isn't just pure speculation? Moxie Marlinspike's Convergence would be the closest thing, iirc. Whenever you access example.com, you ask a handful of user-selected notary servers to access example.com and tell you its TLS cert. If all of them match, you're not being MITMed. You don't have to trust any individual notary server, because it's all of them put together that provide the trust. Of course, trying to figure out a good UX for "my Government and Google say it's fine, but Estonia and Facebook say it's not" in such a way that users aren't going to be severely inconvenienced by a malfunctioning/MITMed notary server but also aren't going to click on "I have no idea what this is just let me see the website" on a MITMed page is hard - probably impossible. Moxie has since given up on it.

Most people, funnily enough, don't run background checks on other people, and don't have a well-formed mental model of why they're necessary and what the security risks in using them are.

mehrdadn 9y ago

> Most people, funnily enough, don't run background checks on other people They don't do it because they're not employers/landlords/etc. and hence the need never arises, not because they somehow have a complete lack of understanding of the concept. > and don't have a well-formed mental model of why they're necessary and what the security risks in using them are They understand why they need to keep their bank passwords safe, and hence they can understand that they shouldn't enter it on someone else's website. They understand what a fake ID or passport is, and they understand why they shouldn't give their ID numbers to random strangers. The specific examples I used are not the point. I explicitly said they're not perfect; they're just there to get a bigger point across. Look at the larger point. The point is people are already dealing with much more complicated stuff on a daily basis. They understand the concept of lying. They understand that identity theft can wreak havoc on their lives. They understand how to prevent it. So they can handle the concept of what it means to enter their credentials on the wrong site. It's not technical and it's not complicated, and it's not necessary for them to understand how exactly doing the wrong thing might lead to an undesirable result. If you'd like to convince me that the average person can't understand this concept, at least support your claim by providing a link to a study or something that isn't based on a cherry-picked strawman version of what I've suggested? Surely someone's already looked into this kind of an approach and what you're saying isn't just pure speculation?

icebraining 9y ago
The issue is not whether they are capable of understanding it, it's that they don't currently, and browsers have to be designed with that fact in mind. Showing them a message like you suggested only works if they already understood it.
- mehrdadn 9y ago
  > The issue is not whether they are capable of understanding it, it's that they don't currently, and browsers have to be designed with that fact in mind. Showing them a message like you suggested only works if they already understood it. But I'm only saying the current UX could become much better, not that they have to switch to my suggested UI by tomorrow. Of course spending some time on user education and transitioning gradually would be a great idea. I was never against that; I'm all for it. So why implicitly rule this out as an impossibility?
vertex-four 9y ago
> They understand why they need to keep their bank passwords safe, and hence they can understand that they shouldn't enter it on someone else's website. Not in my experience - people reuse passwords regularly, and are exceptionally vulnerable to phishing scams, as you should ask anybody working in corporate IT. This is why people actually working in security are very excited about U2F - a U2F-generated token is tied to a specific domain, so password reuse and phishing are both no longer as serious a problem, since a login to scammer.com no longer works as a login to mybank.com. On top of that, people give their bank passwords to e.g. mint.com on a regular basis, when it's specifically asking for their bank password and they have no reason to trust that website. > they understand why they shouldn't give their ID numbers to random strangers Also not in my experience, and the basis of many scams. People at large are terrible at security. We've been moving towards "automatic security" for a while for a reason. And that's before you get to the phenomena where critical thinking goes out the window as soon as something is on a computer instead of "in real life". > Surely someone's already looked into this kind of an approach and what you're saying isn't just pure speculation? Moxie Marlinspike's Convergence would be the closest thing, iirc. Whenever you access example.com, you ask a handful of user-selected notary servers to access example.com and tell you its TLS cert. If all of them match, you're not being MITMed. You don't have to trust any individual notary server, because it's all of them put together that provide the trust. Of course, trying to figure out a good UX for "my Government and Google say it's fine, but Estonia and Facebook say it's not" in such a way that users aren't going to be severely inconvenienced by a malfunctioning/MITMed notary server but also aren't going to click on "I have no idea what this is just let me see the website" on a MITMed page is hard - probably impossible. Moxie has since given up on it.