3 ms·
When you run a service on the web, it's not enough to protect yourself. You must protect your users to the best of your ability. Threats against your users must
by vintermann 4y ago
When you run a service on the web, it's not enough to protect yourself. You must protect your users to the best of your ability. Threats against your users must be part of your threat model.
If not, you won't keep them. They will leave. And saying "caveat emptor" will be about as effective at preventing that as saying "wingardium leviosa".
- 9wzYQbTYsAIc 4y ago> When you run a service on the web, it's not enough to protect yourself Nothing but agreement there. Can you identify a specific recommendation by the IETF or W3C that was ignored, in this case? > And saying "caveat emptor" will be about as effective at preventing that as saying "wingardium leviosa". I had to look up that apparent reference to Harry Potter, but I disagree. Educating your users about phishing risks, aka “caveat emptor” in this context, is explicitly a best practice for mitigating these kinds of security risks on the open web.