3 ms·
As someone who works on developing cybersecurity products, it's incredibly unhelpful to disdain users by assuming the worst case as in > who would download the
by thephyber 6y ago
As someone who works on developing cybersecurity products, it's incredibly unhelpful to disdain users by assuming the worst case as in
> who would download their banking apps from hax0rs.rus
Having empathy with users that don't act perfectly skeptical 100% of the time and who don't read all of the text (like none of us read 100% of the EULAs every time we click the "accept terms" button/checkbox) will allow us to build systems which are more robust to the occasional distracted user, overlooked typo, user who doesn't know how o mentally parse a URL to identify the domain, etc.
Also, there are plenty of people on HN that advocate for breaking down all of the walled garden app stores, which necessarily means that users would have a higher cognitive load of researching which domains are more trusted app stores. It's ridiculously easy not to accidentally download an iOS app from a 3rd party app store, because they simply aren't possible without jailbreak / install developer cert.
- henryfjordan 6y ago> Also, there are plenty of people on HN that advocate for breaking down all of the walled garden app store I think most (myself included) are just advocating for Apple to allow side-loading. They can keep their app store intact. See https://en.wikipedia.org/wiki/Apple_Inc._v._Pepper https://en.wikipedia.org/wiki/Apple_Inc._v._Pepper for more about an ongoing case
- wonderlg 6y agoYou mean installing apps via your less-safe computer? Browsers used to allow any software to side-load extensions and you know how that went: They all moved to store-only installs because all kinds of software were able to affect the browsers. Same way for side-loading apps to your phone. Sure it’s more difficult than just tapping something on the web, but it doesn’t mean it’s safe for the end user.
- Larrikin 6y agoPlease don't use the term all browsers when referring to Chrome. A situation like Ad Nauseum and Chrome would never arise on Firefox.
- deleted 6y ago[deleted]
- userbinator 6y agoAlso, there are plenty of people on HN that advocate for breaking down all of the walled garden app stores, which necessarily means that users would have a higher cognitive load of researching which domains are more trusted app stores How about the bank's own website? I trust that more than any "app store" (which is, after all, run by a third-party) for downloading its app.
- wmf 6y agoThe problem there is phishing. If you trust the bank's site but you don't realize that you aren't on the bank's site then you're screwed. Sure, this doesn't apply to you; it only applies to 90% of humanity.
- deleted 6y ago[deleted]
- thephyber 6y agoI'm not sure why this is being downvoted. Return navigating to the bank website by bookmark on the OS/browser is great. Via link from SMS/Email... not so much.
- deleted 6y ago[deleted]
- dogma1138 6y agoThe state of URL readability on mobile platforms is terrible, people fall for phishing all the time it’s easy to blame the users but it’s a solution to the problem. Phishing via email, texts and ads in apps heck even Google at times had phishing URLs come up in search results, CDNs being compromised and transport attacks (e.g. hotspots) make distribution over browsers a problem. AppStores allow you at least in theory to validate an app not only to be the app that you want to download but also that the app does what the developer claims it does, it also facilitates distribution segmentation by region and device (especially important for Android) and automatic updates. Not sure about you but I’ll trust the Apple AppStore more than any given bank website simply by being familiar with the security teams and practices in FAANG vs commercial banking.