4 ms·

We really need to educate people if they think installing an untrusted exe from a sketchy "free" VPN service is acceptable behavior.

Rjevski 8y ago
I wish there would be real, large-scale consequences for getting your computer compromised. At the moment, unless you’re a celebrity or other high-profile individual, there isn’t really anything that can happen - the main financial risk - credit card fraud - will be refunded by the bank. Should banks stop taking liability for idiot’s stupidity, all it would take is a few published cases of people getting their life savings emptied because of malware and idiots will wisen up or refrain from using the internet (which is fine too).
- flyinghamster 8y ago
  That's all well and good until you get taken by a card skimmer or a compromised credit card terminal.
  - ourmandave 8y ago
    Or a 3rd party malware ad from a site you trusted. Or your identity stolen from the Equifax breach. Or the countless other times customer data was stolen. Or foreign state massive router hacks. But yeah, let's put that on idiot grandmas.
- adrianN 8y ago
  I'd be against that. The damage a single computer can do is minuscule compared to, say, a car accident. So any penalties that amount to more than peanuts for anybody in a first world country would be unfair. How about we first try to get companies liable for selling insecure IoT devices, or for not providing security updates for cell phones that work just fine?
- isostatic 8y ago
  > all it would take is a few published cases of people getting their life savings emptied because of malware and idiots will wisen up or refrain from using the internet (which is fine too). There's always sob stories* about how little old granny lost her savings because of some scam website Yet people still fall for them, especially the ones that promise to get rich quick. From Nigerian princes to bitcoing investing This one has been advertised with fake newspaper reports about how it was on "Dragons Den" (I believe it's Shark Tank in the U.S.): https://bitcoin-trader.biz/ https://bitcoin-trader.biz/ When people fall for What kind of results can I expect? Bitcoin Trader members typically profit a minimum of $13,000 daily. there's simply no helping them * (Usually from the kids/grandkids who wanted the money instead)
- freehunter 8y ago
  As much as I'd like computer security to become a solved problem, this outlook is ignoring the banks role in the transaction. In my opinion banks don't go far enough to verify identity or to verify a transaction is legitimate. The fact that someone who has never met me can walk into a bank with some pieces of information they got on the Internet and open a new bank account or credit card is scary. That's why it's so easy to refund this fraud, because banks don't want people to realize that their security is just a bunch of meaningless paperwork. I also don't think people losing their life savings will change anything. Ponzi schemes are still a big thing, MLM is still a big thing, Nigerian princes are still a big thing, and people lose it all through those scams constantly. The state of bank security is so bad that every time I write a check, I'm giving the recipient my bank's name, my account number, my home address, and my signature. That's a lot of sensitive information that a phisher could do some real damage with. Ultimately, if a fraudulent transaction clears the bank, it is the bank's fault. It's their job to verify transactions and verify identity before clearing the transaction. In a perfect world, financial malware would cease to exist because bank security was locked down so tight that fraudulent transactions would never clear.
  - sliken 8y ago
    I agree. Kinda baffled why banks don't push for a hardened hardware platform. I've always wanted a hardware token type widget that would display any pending transactions on my credit card. If I push the approve button the transaction would be signed with my public key and sent to the vendor. Seems insane that my credit card number is displayed in plain text to anyone I deal with in the physical world and is enough for anyone else on the planet to charge my account.
- etaioinshrdlu 8y ago
  Such a mean atitude.
zaarn 8y ago
It's a useless thing to want. Most users can be safely assumed to operate on the same intelligence level as a chipmunk the moment they are handed a keyboard. I've met people who had difficulty handling the instruction "open excel" because excel wasn't in the familiar spot on the desktop and confused "save and exit word" with "hold power button for 5 seconds" without a malicious thought. People still install sketchy Apps and "Make your computer clean", they respond to emails from the nigerian prince about his money and pills to make body parts larger and they will continue to remain ignorant of the dangers lurking in the internet. Instead of educating them we should protect them. Users will do dumb things and we need to make sure that when a user wants to do a dumb thing they know it's a dumb thing. Sysadmins may install a rootkit on purpose or may install a self-signed driver. The average user should under no circumstance be given the power to install a self-signed anything. Give the sysadmins power and prevent the user from abusing it.
- hutzlibu 8y ago
  "Give the sysadmins power and prevent the user from abusing it." Yes, but don't treat me as a idiot, when I am admin. And windows does that increasingly to a point where I simply hate it. (even though I only use Windows if I have to)

Rjevski 8y ago

I wish there would be real, large-scale consequences for getting your computer compromised. At the moment, unless you’re a celebrity or other high-profile individual, there isn’t really anything that can happen - the main financial risk - credit card fraud - will be refunded by the bank. Should banks stop taking liability for idiot’s stupidity, all it would take is a few published cases of people getting their life savings emptied because of malware and idiots will wisen up or refrain from using the internet (which is fine too).

flyinghamster 8y ago
That's all well and good until you get taken by a card skimmer or a compromised credit card terminal.
- ourmandave 8y ago
  Or a 3rd party malware ad from a site you trusted. Or your identity stolen from the Equifax breach. Or the countless other times customer data was stolen. Or foreign state massive router hacks. But yeah, let's put that on idiot grandmas.
adrianN 8y ago
I'd be against that. The damage a single computer can do is minuscule compared to, say, a car accident. So any penalties that amount to more than peanuts for anybody in a first world country would be unfair. How about we first try to get companies liable for selling insecure IoT devices, or for not providing security updates for cell phones that work just fine?
isostatic 8y ago
> all it would take is a few published cases of people getting their life savings emptied because of malware and idiots will wisen up or refrain from using the internet (which is fine too). There's always sob stories* about how little old granny lost her savings because of some scam website Yet people still fall for them, especially the ones that promise to get rich quick. From Nigerian princes to bitcoing investing This one has been advertised with fake newspaper reports about how it was on "Dragons Den" (I believe it's Shark Tank in the U.S.): https://bitcoin-trader.biz/ https://bitcoin-trader.biz/ When people fall for What kind of results can I expect? Bitcoin Trader members typically profit a minimum of $13,000 daily. there's simply no helping them * (Usually from the kids/grandkids who wanted the money instead)
freehunter 8y ago
As much as I'd like computer security to become a solved problem, this outlook is ignoring the banks role in the transaction. In my opinion banks don't go far enough to verify identity or to verify a transaction is legitimate. The fact that someone who has never met me can walk into a bank with some pieces of information they got on the Internet and open a new bank account or credit card is scary. That's why it's so easy to refund this fraud, because banks don't want people to realize that their security is just a bunch of meaningless paperwork. I also don't think people losing their life savings will change anything. Ponzi schemes are still a big thing, MLM is still a big thing, Nigerian princes are still a big thing, and people lose it all through those scams constantly. The state of bank security is so bad that every time I write a check, I'm giving the recipient my bank's name, my account number, my home address, and my signature. That's a lot of sensitive information that a phisher could do some real damage with. Ultimately, if a fraudulent transaction clears the bank, it is the bank's fault. It's their job to verify transactions and verify identity before clearing the transaction. In a perfect world, financial malware would cease to exist because bank security was locked down so tight that fraudulent transactions would never clear.
- sliken 8y ago
  I agree. Kinda baffled why banks don't push for a hardened hardware platform. I've always wanted a hardware token type widget that would display any pending transactions on my credit card. If I push the approve button the transaction would be signed with my public key and sent to the vendor. Seems insane that my credit card number is displayed in plain text to anyone I deal with in the physical world and is enough for anyone else on the planet to charge my account.
etaioinshrdlu 8y ago
Such a mean atitude.

zaarn 8y ago

It's a useless thing to want. Most users can be safely assumed to operate on the same intelligence level as a chipmunk the moment they are handed a keyboard. I've met people who had difficulty handling the instruction "open excel" because excel wasn't in the familiar spot on the desktop and confused "save and exit word" with "hold power button for 5 seconds" without a malicious thought. People still install sketchy Apps and "Make your computer clean", they respond to emails from the nigerian prince about his money and pills to make body parts larger and they will continue to remain ignorant of the dangers lurking in the internet. Instead of educating them we should protect them. Users will do dumb things and we need to make sure that when a user wants to do a dumb thing they know it's a dumb thing. Sysadmins may install a rootkit on purpose or may install a self-signed driver. The average user should under no circumstance be given the power to install a self-signed anything. Give the sysadmins power and prevent the user from abusing it.

hutzlibu 8y ago
"Give the sysadmins power and prevent the user from abusing it." Yes, but don't treat me as a idiot, when I am admin. And windows does that increasingly to a point where I simply hate it. (even though I only use Windows if I have to)