3 ms·

We could say the same thing about phishing attacks. “Any company that hires idiots so dumb they’ll type their password into a random site without confirming the

by varenc 5y ago

We could say the same thing about phishing attacks. “Any company that hires idiots so dumb they’ll type their password into a random site without confirming the certificate deserves what’s coming to them”. Except we know that at scale very large organizations, i.e. Google, cannot 100% stop phishing attacks just by user training. Humans are always fallible in a large enough group. The solution for phishing protection is to take the human out of the equation and rely on something like U2F to perform the authenticity check for you.

dwaite 5y ago
To elaborate the parent's point, Google switched away from employee training as the primary means to prevent phishing attacks to WebAuthn security keys. Their phishing incidents dropped to zero. https://krebsonsecurity.com/2018/07/google-security-keys-neutralized-employee-phishing/ https://krebsonsecurity.com/2018/07/google-security-keys-neu...
- varenc 5y ago
  Thank you! I recalled that story but wasn't sure on the details.
- MrYellowP 5y ago
  Yes, but it's not actually a solution. It maintains the status quo and only prevents its consequences. The problem, simplified: People are dumb. The solution: Making people smarter. Not a solution: Keeping people dumb and preventing them from making stupid mistakes.
MrYellowP 5y ago
> Humans are always fallible in a large enough group To make sure that everyone, who will eventually read this, understand what this line actually means, is: There's always an idiot falling through the cracks. Yes. It's inevitable. It happens. Doesn't change the fact that if people were more rational and less driven by their feelings, less people would be falling for scams and thus less scams would exist. Anyone who doesn't understand that scams solely exist because they work, is excused. Anyone who disagrees with the idea that people need to act in a rational, self responsible manner is a part of the problem. The cause of scams is people, who aren't thinking things through, falling for them. If schools nowadays didn't raise people into mostly being thoughtless robots, the world would be a better place as a whole, scams included. Of course there's always going to be one guy. Doesn't change the rest at all. You're making good the enemy of perfect and your solution in no way or form actually improves us, as humans, and instead removes even more responsibility away from us.

by varenc 5y ago

dwaite 5y ago

To elaborate the parent's point, Google switched away from employee training as the primary means to prevent phishing attacks to WebAuthn security keys. Their phishing incidents dropped to zero. https://krebsonsecurity.com/2018/07/google-security-keys-neutralized-employee-phishing/ https://krebsonsecurity.com/2018/07/google-security-keys-neu...

varenc 5y ago
Thank you! I recalled that story but wasn't sure on the details.
MrYellowP 5y ago
Yes, but it's not actually a solution. It maintains the status quo and only prevents its consequences. The problem, simplified: People are dumb. The solution: Making people smarter. Not a solution: Keeping people dumb and preventing them from making stupid mistakes.

MrYellowP 5y ago

> Humans are always fallible in a large enough group To make sure that everyone, who will eventually read this, understand what this line actually means, is: There's always an idiot falling through the cracks. Yes. It's inevitable. It happens. Doesn't change the fact that if people were more rational and less driven by their feelings, less people would be falling for scams and thus less scams would exist. Anyone who doesn't understand that scams solely exist because they work, is excused. Anyone who disagrees with the idea that people need to act in a rational, self responsible manner is a part of the problem. The cause of scams is people, who aren't thinking things through, falling for them. If schools nowadays didn't raise people into mostly being thoughtless robots, the world would be a better place as a whole, scams included. Of course there's always going to be one guy. Doesn't change the rest at all. You're making good the enemy of perfect and your solution in no way or form actually improves us, as humans, and instead removes even more responsibility away from us.