3 ms·
The problem is that the barrage of "Is this really you?" checks desensitises people to putting in passwords, 2FA tokens, clicking on captchas and other such thi
by Gordonjcp 4y ago
The problem is that the barrage of "Is this really you?" checks desensitises people to putting in passwords, 2FA tokens, clicking on captchas and other such things.
Most people on HN are American so have no direct experience or knowledge of terrorism, but in the UK a favourite trick of Republican terrorists was to call in hoax bomb threat after hoax bomb threat, causing massive disruption with maybe only one or two real devices for every dozen or so incidents. People got a bit blasé about it, so when the real attacks happened they were much worse than they would otherwise have been.
If you continually blast users with "OMG CRIMINALS MIGHT BE STEALING YOUR DATA CLICK HERE TO STOP THEM" then you're just priming them to be a big fat source of information when a suitably-crafted attack site pops up its message.
- 0xbadcafebee 4y agoI agree that's a problem. But as long as I've been around, theres' always been a fine line between usability and security. You introduce one change to fix one problem and it creates another. You try to simplify and end up over-simplifying. You give users more control and they choose convenience over security, which for a very large population or critical infrastructure has larger ripple effects (every compromise is a foothold into another compromise). There are other solutions, like FIDO2 with a hardware token and approval button, but that has its own drawbacks and adoption is slow. Every solution is kinda sucky :(