4 ms·

Only computers let bad people drain bank accounts at scale.

by jshen 2y ago

lapcat 2y ago
Please cite the statistics on the volume of bank account draining before you claim that it happens "at scale".
- spacedcowboy 2y ago
  I mean, the nigerian prince scam is almost a meme these days…
  - lapcat 2y ago
    A meme is not a statistic. Exactly how many people have fallen for the scam, out of all computer users. And how exactly does device vendor lockdown stop this particular scam?
    - spacedcowboy 2y ago
      > Exactly how many people have fallen for the scam, out of all computer users Who the fuck knows ? And how is that even remotely a useful question to ask - it's not answerable, those who commit the scam are the only people with the figures, and there's no "register of fuckers who scam other people" where they have to tell you how well they do. > how exactly does device vendor lockdown stop this particular scam Premise 1: All (for a suitable definition of "all") computer users are clueless when it comes to internet security Premise 2: You are not trying to help any given individual's security, because some of them violate premise #1. You are trying to raise the bar for the clueless hurting themselves. Premise 3: It is not about "personal freedom". It is about preventing the clueless (by no fault of their own, this shit is complicated) becoming drones and mules for attacks on others. It is an attempt to increase the greater good at the expense of placing restrictions on what any individual can do on their own phone. Those restrictions can be mitigated mainly by coughing up $100/year, which is a sufficient bar to prevent bad guys from doing it en-masse, but not so high as to prevent the people who want to do stuff from doing it. Stopping people doing stupid stuff because they don't know any better is the goal, and that inevitably gets more and more restrictive as time progresses, because an arms race is instituted between the truly evil arseholes who prey on the clueless, and the manufacturers who don't want their produces seen as vehicles leading the clueless to the slaughter. Personally I don't give a crap. The iPhone is fine for me as-is, I can install my own software on my own phone, and sure it costs $100/year. That's not a big deal IMHO, in terms of outgoings it barely registers above the noise floor. YMMV.
      - lapcat 2y ago
        > Who the fuck knows ? And how is that even remotely a useful question to ask - it's not answerable, those who commit the scam are the only people with the figures, and there's no "register of fuckers who scam other people" where they have to tell you how well they do. Um, why do crime statistics have to come from the perpetrators rather than from the victims? The victims report the crimes, duh. Anyway, you spent a lot of words avoiding my question, which is how exactly does vendor lockdown stop the Nigerian prince scam? You're arguing that vendor lockdown is supposed to protect consumers, but you can't seem to explain how or how often.
        spacedcowboy 2y ago
        > Um, why do crime statistics have to come from the perpetrators rather than from the victims? The victims report the crimes, duh. You asked for (quoting) "Exactly how many people have fallen for the scam, out of all computer users". Not every crime is reported, duh. > Anyway, you spent a lot of words avoiding my question Nope. I can't answer the question because it's non-answerable. If you believe that nobody has ever fallen for phishing, Nigerian-prince, etc. etc. scams, well, I don't know what colour the sky is on your world, but it's not the same as on mine... If you further believe that allowing everyone root access to devices that are also linked directly to their bank accounts, social security numbers, driving licenses, etc. etc. Then again, sky colour becomes an issue. You seem technically savvy. I do not believe you are typical of the average phone user. I think the restrictions in place are a necessary tragedy of the commons, to prevent the destruction of trust in the system as a whole. As I said, YMMV, and I'm not saying I particularly like the situation, just that I think it's necessary, and opening up everything to everyone is a foolish, idealistic, and hopelessly naive idea.
        lapcat 2y ago
        > You asked for (quoting) "Exactly how many people have fallen for the scam, out of all computer users". Not every crime is reported, duh. Not every crime is reported, but it's indisputable that a lot of crimes are reported. So give me a statistic, any reported statistic. > If you believe that nobody has ever fallen for phishing, Nigerian-prince, etc. etc. scams, well, I don't know what colour the sky is on your world, but it's not the same as on mine... How do you know this, except from reports by victims? That's what I'm asking for. And once again, you haven't explained the mechanism by which vendor lockdown prevents this scam. However many or few victims there are of the scam, precisely zero of them are helped by vendor lockdown. I'm not going to stop asking how to explain how vendor lockdown is event relevant here. > If you further believe that allowing everyone root access to devices that are also linked directly to their bank accounts, social security numbers, driving licenses, etc. etc. This is hand waving, and it's not clear how root access by the owner of the device somehow exposes userland data to criminals. Moreover, all of this data is on desktop computers, and it's mostly fine.
  - dTal 2y ago
    Interesting example. How does denying root to the user mitigate this attack?
    - jshen 2y ago
      Much harder to install a key logger or other such shenanigans.
      - dTal 2y ago
        Install a key logger, when they already have someone on the end of the line willing to install and run whatever software they request? Why? I think the marginal security value of denying root on the computer when you have already wangled root on the human is small.
        jshen 2y ago
        Prior to modern AI, one could be done at scale, now I suppose both can which may change my calculus on this one. I hadn't thought about that until your comment. Thanks!
  - ElevenLathe 2y ago
    This scam is much older than the Internet or even computers. It was called a Spanish Prisoner scam in the 19th century but I would be surprised if it wasn't happening in the ancient world via cuneiform tablets.

Only computers let bad people drain bank accounts at scale.

by jshen 2y ago

Only computers let bad people drain bank accounts at scale.

lapcat 2y ago

Please cite the statistics on the volume of bank account draining before you claim that it happens "at scale".

spacedcowboy 2y ago
I mean, the nigerian prince scam is almost a meme these days…
- lapcat 2y ago
  A meme is not a statistic. Exactly how many people have fallen for the scam, out of all computer users. And how exactly does device vendor lockdown stop this particular scam?
  - spacedcowboy 2y ago
    > Exactly how many people have fallen for the scam, out of all computer users Who the fuck knows ? And how is that even remotely a useful question to ask - it's not answerable, those who commit the scam are the only people with the figures, and there's no "register of fuckers who scam other people" where they have to tell you how well they do. > how exactly does device vendor lockdown stop this particular scam Premise 1: All (for a suitable definition of "all") computer users are clueless when it comes to internet security Premise 2: You are not trying to help any given individual's security, because some of them violate premise #1. You are trying to raise the bar for the clueless hurting themselves. Premise 3: It is not about "personal freedom". It is about preventing the clueless (by no fault of their own, this shit is complicated) becoming drones and mules for attacks on others. It is an attempt to increase the greater good at the expense of placing restrictions on what any individual can do on their own phone. Those restrictions can be mitigated mainly by coughing up $100/year, which is a sufficient bar to prevent bad guys from doing it en-masse, but not so high as to prevent the people who want to do stuff from doing it. Stopping people doing stupid stuff because they don't know any better is the goal, and that inevitably gets more and more restrictive as time progresses, because an arms race is instituted between the truly evil arseholes who prey on the clueless, and the manufacturers who don't want their produces seen as vehicles leading the clueless to the slaughter. Personally I don't give a crap. The iPhone is fine for me as-is, I can install my own software on my own phone, and sure it costs $100/year. That's not a big deal IMHO, in terms of outgoings it barely registers above the noise floor. YMMV.
    - lapcat 2y ago
      > Who the fuck knows ? And how is that even remotely a useful question to ask - it's not answerable, those who commit the scam are the only people with the figures, and there's no "register of fuckers who scam other people" where they have to tell you how well they do. Um, why do crime statistics have to come from the perpetrators rather than from the victims? The victims report the crimes, duh. Anyway, you spent a lot of words avoiding my question, which is how exactly does vendor lockdown stop the Nigerian prince scam? You're arguing that vendor lockdown is supposed to protect consumers, but you can't seem to explain how or how often.
      - spacedcowboy 2y ago
        > Um, why do crime statistics have to come from the perpetrators rather than from the victims? The victims report the crimes, duh. You asked for (quoting) "Exactly how many people have fallen for the scam, out of all computer users". Not every crime is reported, duh. > Anyway, you spent a lot of words avoiding my question Nope. I can't answer the question because it's non-answerable. If you believe that nobody has ever fallen for phishing, Nigerian-prince, etc. etc. scams, well, I don't know what colour the sky is on your world, but it's not the same as on mine... If you further believe that allowing everyone root access to devices that are also linked directly to their bank accounts, social security numbers, driving licenses, etc. etc. Then again, sky colour becomes an issue. You seem technically savvy. I do not believe you are typical of the average phone user. I think the restrictions in place are a necessary tragedy of the commons, to prevent the destruction of trust in the system as a whole. As I said, YMMV, and I'm not saying I particularly like the situation, just that I think it's necessary, and opening up everything to everyone is a foolish, idealistic, and hopelessly naive idea.
        lapcat 2y ago
        > You asked for (quoting) "Exactly how many people have fallen for the scam, out of all computer users". Not every crime is reported, duh. Not every crime is reported, but it's indisputable that a lot of crimes are reported. So give me a statistic, any reported statistic. > If you believe that nobody has ever fallen for phishing, Nigerian-prince, etc. etc. scams, well, I don't know what colour the sky is on your world, but it's not the same as on mine... How do you know this, except from reports by victims? That's what I'm asking for. And once again, you haven't explained the mechanism by which vendor lockdown prevents this scam. However many or few victims there are of the scam, precisely zero of them are helped by vendor lockdown. I'm not going to stop asking how to explain how vendor lockdown is event relevant here. > If you further believe that allowing everyone root access to devices that are also linked directly to their bank accounts, social security numbers, driving licenses, etc. etc. This is hand waving, and it's not clear how root access by the owner of the device somehow exposes userland data to criminals. Moreover, all of this data is on desktop computers, and it's mostly fine.
- dTal 2y ago
  Interesting example. How does denying root to the user mitigate this attack?
  - jshen 2y ago
    Much harder to install a key logger or other such shenanigans.
    - dTal 2y ago
      Install a key logger, when they already have someone on the end of the line willing to install and run whatever software they request? Why? I think the marginal security value of denying root on the computer when you have already wangled root on the human is small.
      - jshen 2y ago
        Prior to modern AI, one could be done at scale, now I suppose both can which may change my calculus on this one. I hadn't thought about that until your comment. Thanks!
- ElevenLathe 2y ago
  This scam is much older than the Internet or even computers. It was called a Spanish Prisoner scam in the 19th century but I would be surprised if it wasn't happening in the ancient world via cuneiform tablets.