3 ms·

I mean, one can easily make the argument that this an incredibly rare instance where the global south get to be the exploiters as opposed to the exploited, and

I mean, one can easily make the argument that this an incredibly rare instance where the global south get to be the exploiters as opposed to the exploited, and online scams could be argued as a "colonialism tax" on the richer, dumber citizens of western nations that are used to a government that at least feigns giving a shit about their security. I'm not saying that's right, of course, something something two wrongs. I don't condone it but I don't judge them for it either. As with most crime, the answer largely seems to be elevating the communities from which the crime comes, because while there's certainly a non-zero population out there that will just fuck shit up for their own gain, regardless of how harmful and risky it is, numerous studies on the subject and the successful rehabilitation programs in other countries not using a punitive system of justice demonstrate that the vast majority of the time, what "criminals" really need is a legal option to make a decent living. That can require a wide spectrum of things from proper education/skills training for that given person, to environmental or medical help to address untreated mental/physical illnesses, to systemic improvements so jobs pay enough to actually live and are available where people are. Basically: Our society demands people have money to survive, and most people given a reasonable opportunity to earn money in a pro-social way will do that, because if for no other reason, it's easier and less risky. However if you live in a place where you are denied the opportunity to make that living, what do you expect people to do? Lie down and wait for the cold embrace of death, or start stealing shit? Put in that position I'd tell you exactly what I'd do.

AnthonyMouse 3y ago
> online scams could be argued as a "colonialism tax" on the richer, dumber citizens of western nations that are used to a government that at least feigns giving a shit about their security. Which brings us to the actual problem that causes these others. We don't put the consequences of bad security practices on the people who could have taken better precautions because they're "the victim" even though they're also the only person who could have prevented it. So instead we move the cost to the merchant via the credit card companies etc., or some other intermediary whose fault it was not. Which removes the incentive for ordinary people to care about security, and then they don't. Who cares if your IoT garbage provides an entry point into your home network and some Russians get your credit card number? Don't spend time choosing a device with open source firmware that gets indefinite community support. Don't worry about giving your credit card number to scammers. Just buy whatever's cheap and when it happens you can call the credit card company and make it their problem. Which in turn makes it the credit card company's problem, which they don't like, so they start asking for awful cybercrime bills to do something about this, even though the only something that works is to make consumers feel meaningful consequences for not caring about security.
- grotorea 3y ago
  Are people that indifferent to cybersecurity in your opinion? There are lots of ways to lose money that can't that easily be clawed back.
  - AnthonyMouse 3y ago
    People are indifferent specifically in the cases that it can be clawed back. They keep their valuables in a safe etc. But they're much more willing to give their credit card to shady websites than their bank routing info, specifically because it's easier to claw it back if there is fraud. But it isn't the criminal who pays for that. They get your credit card number via their shady website, then use it on a legitimate one, take possession of the goods and leave the legitimate merchant to take the chargeback when the user sees the fraudulent transaction on their credit card statement weeks later. The users also persist in using credit cards, instead of demanding a system with better security, e.g. one in which the card contains a chip that can connect to a PC or phone and requires the card to be physically present for the first remote transaction with a given merchant (you sign their key as authorized to charge you going forward), so you couldn't just breach one merchant, get all their customers' credit card info and use them fraudulently at any other merchant.
- ToucanLoucan 3y ago
  > We don't put the consequences of bad security practices on the people who could have taken better precautions because they're "the victim" even though they're also the only person who could have prevented it. So instead we move the cost to the merchant via the credit card companies etc., or some other intermediary whose fault it was not. Eeeeeehhhhhhhhhhh waves hand The fact that tons and tons of what constitutes the backend of modern finance tech is the exact same shit that was originally built in the 70's is not something that I think can be overlooked so easily. A lot of what constitutes that ecosystem is just, practically allergic to security. Your social security number (if you're American) for example is basically a unified ID number that corresponds to everything from your medical records to your credit report to bank accounts to insurance, on and on, and accessing information with that number is nearly completely insecure. If someone gets ahold of yours and your basic public info, they can turn your life upside-down in such a way that will take hundreds of hours and thousands of dollars to resolve. And it would be like, trivial to lock that behind some sort of MFA situation with a state-centralized solution. The entire ecosystem around EFTs is just incredibly needlessly bloated and slow. I understand why they were slow when I was born, right? But we have advanced so much since then and yet EFTs despite just being like... digital checks remain basically inaccessible to working class people, despite them being objectively useful and, again, literally just checks in a different form. And their difficulty in use and desire for people to use something like them has given birth in turn to entire new financial products and services, many of which are pretty scammy in their own right, and subject to their own risks of abuse with even less overall security since most are tech companies and not insured with the FDIC. That's not to say that people shouldn't be security conscious, of course they should be. But that requires education on how to be that, and frankly I don't think it's unreasonable to say that the finance sector could, itself, make being security conscious quite a bit easier without dinging their own profits too badly.

AnthonyMouse 3y ago

> online scams could be argued as a "colonialism tax" on the richer, dumber citizens of western nations that are used to a government that at least feigns giving a shit about their security. Which brings us to the actual problem that causes these others. We don't put the consequences of bad security practices on the people who could have taken better precautions because they're "the victim" even though they're also the only person who could have prevented it. So instead we move the cost to the merchant via the credit card companies etc., or some other intermediary whose fault it was not. Which removes the incentive for ordinary people to care about security, and then they don't. Who cares if your IoT garbage provides an entry point into your home network and some Russians get your credit card number? Don't spend time choosing a device with open source firmware that gets indefinite community support. Don't worry about giving your credit card number to scammers. Just buy whatever's cheap and when it happens you can call the credit card company and make it their problem. Which in turn makes it the credit card company's problem, which they don't like, so they start asking for awful cybercrime bills to do something about this, even though the only something that works is to make consumers feel meaningful consequences for not caring about security.

grotorea 3y ago
Are people that indifferent to cybersecurity in your opinion? There are lots of ways to lose money that can't that easily be clawed back.
- AnthonyMouse 3y ago
  People are indifferent specifically in the cases that it can be clawed back. They keep their valuables in a safe etc. But they're much more willing to give their credit card to shady websites than their bank routing info, specifically because it's easier to claw it back if there is fraud. But it isn't the criminal who pays for that. They get your credit card number via their shady website, then use it on a legitimate one, take possession of the goods and leave the legitimate merchant to take the chargeback when the user sees the fraudulent transaction on their credit card statement weeks later. The users also persist in using credit cards, instead of demanding a system with better security, e.g. one in which the card contains a chip that can connect to a PC or phone and requires the card to be physically present for the first remote transaction with a given merchant (you sign their key as authorized to charge you going forward), so you couldn't just breach one merchant, get all their customers' credit card info and use them fraudulently at any other merchant.
ToucanLoucan 3y ago
> We don't put the consequences of bad security practices on the people who could have taken better precautions because they're "the victim" even though they're also the only person who could have prevented it. So instead we move the cost to the merchant via the credit card companies etc., or some other intermediary whose fault it was not. Eeeeeehhhhhhhhhhh waves hand The fact that tons and tons of what constitutes the backend of modern finance tech is the exact same shit that was originally built in the 70's is not something that I think can be overlooked so easily. A lot of what constitutes that ecosystem is just, practically allergic to security. Your social security number (if you're American) for example is basically a unified ID number that corresponds to everything from your medical records to your credit report to bank accounts to insurance, on and on, and accessing information with that number is nearly completely insecure. If someone gets ahold of yours and your basic public info, they can turn your life upside-down in such a way that will take hundreds of hours and thousands of dollars to resolve. And it would be like, trivial to lock that behind some sort of MFA situation with a state-centralized solution. The entire ecosystem around EFTs is just incredibly needlessly bloated and slow. I understand why they were slow when I was born, right? But we have advanced so much since then and yet EFTs despite just being like... digital checks remain basically inaccessible to working class people, despite them being objectively useful and, again, literally just checks in a different form. And their difficulty in use and desire for people to use something like them has given birth in turn to entire new financial products and services, many of which are pretty scammy in their own right, and subject to their own risks of abuse with even less overall security since most are tech companies and not insured with the FDIC. That's not to say that people shouldn't be security conscious, of course they should be. But that requires education on how to be that, and frankly I don't think it's unreasonable to say that the finance sector could, itself, make being security conscious quite a bit easier without dinging their own profits too badly.