4 ms·

No, you’re not wrong. People don’t care. They don’t even know that they should care. People have no clue how their PC or smartphone or internet access work. Th

No, you’re not wrong. People don’t care. They don’t even know that they should care. People have no clue how their PC or smartphone or internet access work. They don’t know what a hard drive is, they don’t know what encryption does, and their brain will explode if you try to explain what a MITM attack is. They just know that they had to return to the store last time they forgot their password so the geek with the “Apple Genius” T-shirt could reset it for them. So now it’s set to the kid’s birthdate. Because they don’t know how any of that stuff works, they have no choice but to trust the closest thing they have to an authority on the subject: their ISP, the guys who make their smartphone or their bank’s website, that salesperson at Best Buy who told them to install an antivirus. Security is hard. Remembering passwords is complicated, picking good passwords is near impossible if you don’t have a tool to do it for you, and remembering those passwords is impossible. 2FA is a pain to set up even if ou know what you’re doing, and don’t even get me started on configuring “advanced” options (in which I bundle Fido2 / U2F for the foreseeable future). And recovery keys you’re supposed to print out and store in a safe, seriously? Data is intangible. Contrary to a car theft or a house break-in, people struggle to assign a value to data loss or theft. Hell, I work in IT and I couldn’t begin to estimate the prejudice if someone were to gain access to my personal data. LoJacks and baby monitors help secure something that people can place a value on. What’s the value of my holiday pics? Because of all this, security doesn’t sell. So companies have no incentive to invest in security, so security remains complicated and rare, so nobody gets to use good security and find out that it has a value, so security doesn’t sell. I can’t even say that it will get better over time, as the young generations were raised to hand over control of their digital lives to corporate data harvesters. Sorry for the bleakness of this post, but I’ve chosen to be jaded rather than depressed.

quilombodigital 8y ago
Ok, in your opinion the digital security concept is hard to grasp for the common user. What is the excuse for the average company to not enforce a policy?
- BjoernKW 8y ago
  > What is the excuse for the average company to not enforce a policy? Oh, but most companies do enforce such a policy. Often, however, these policies do more harm than good such when they require passwords of a specific length and composition or demand you change those every 30 days. Rules like that lead precisely to passwords that are easy to guess but hard to remember. I suppose nobody can even tell anymore who originally came up with these rules but they're widespread and ingrained in many companies' cultures. Getting rid of this security cargo cult and replacing it with better practices (such as using password managers and allowing for easily pronounceable, diceware-like passwords) is surprisingly hard.
- laurentl 8y ago
  What BjoernKW said, basically. Companies do enforce security policies. Most often, there’s a bit of cargo culting / going through the motions to prove to compliance or the SEC or whoever that you’re doing something. It’s also complicated, on (large) companies’ timescales, to adapt to the changing threat models. Which is why we still have “8 characters including a number and an upper-case letter, to be changed every 3 months” nonsense instead of generalized password managers and MFA devices. (Try installing a password manager on your average locked-down corporate PC). And even then, you’re still back to the fact that companies are large groups of people who range from Franck the IT guy who knows about security to Dennis from accounting who has all his passwords on a post-it and will gladly give them over the phone if “Gladys, the VP of marketing who needs access to the finance tool to update the budget forecast right away, before the big meeting with the CEO, you don’t want to upset the CEO do you Dennis” sounds persuasive enough. However, I agree that companies are better at security than individuals, and will (hopefully) slowly drag the average security level up through employee education. It will take a while for the Dennises of the world to get the message, though.

quilombodigital 8y ago

Ok, in your opinion the digital security concept is hard to grasp for the common user. What is the excuse for the average company to not enforce a policy?

BjoernKW 8y ago
> What is the excuse for the average company to not enforce a policy? Oh, but most companies do enforce such a policy. Often, however, these policies do more harm than good such when they require passwords of a specific length and composition or demand you change those every 30 days. Rules like that lead precisely to passwords that are easy to guess but hard to remember. I suppose nobody can even tell anymore who originally came up with these rules but they're widespread and ingrained in many companies' cultures. Getting rid of this security cargo cult and replacing it with better practices (such as using password managers and allowing for easily pronounceable, diceware-like passwords) is surprisingly hard.
laurentl 8y ago
What BjoernKW said, basically. Companies do enforce security policies. Most often, there’s a bit of cargo culting / going through the motions to prove to compliance or the SEC or whoever that you’re doing something. It’s also complicated, on (large) companies’ timescales, to adapt to the changing threat models. Which is why we still have “8 characters including a number and an upper-case letter, to be changed every 3 months” nonsense instead of generalized password managers and MFA devices. (Try installing a password manager on your average locked-down corporate PC). And even then, you’re still back to the fact that companies are large groups of people who range from Franck the IT guy who knows about security to Dennis from accounting who has all his passwords on a post-it and will gladly give them over the phone if “Gladys, the VP of marketing who needs access to the finance tool to update the budget forecast right away, before the big meeting with the CEO, you don’t want to upset the CEO do you Dennis” sounds persuasive enough. However, I agree that companies are better at security than individuals, and will (hopefully) slowly drag the average security level up through employee education. It will take a while for the Dennises of the world to get the message, though.