4 ms·

It's more complicated than that. Like physical security, computer security is applied risk management. Your house probably doesn't have solid metal doors, met

by rwg 14y ago

It's more complicated than that. Like physical security, computer security is applied risk management. Your house probably doesn't have solid metal doors, metal bars over the windows, laser tripwires, a patrolling security guard, and angry Doberman Pinschers. All of those things would increase your home's security, but the cost of the security probably doesn't make sense compared to the risks involved with your house getting burgled. Similarly, Hacker News doesn't require client TLS certificates, two-factor authentication, and insanely complex passwords. The risk of horrible and/or costly things happening because someone's HN account got broken into really isn't there, so implementing those security measures doesn't make much sense. Even if the author's bank's security picture doesn't actually decrease fraud at all, the security picture was probably cheap to implement, required minimal user and employee training, and keeps the lawyers and regulators happy. The bank's risk exposure decreases, even if the author's doesn't.

vog 14y ago
> ... the security picture was probably cheap to implement ... Although the implementation might have been cheap, there's another factor to consider: If a system provides a false sense of security, this almost certainly decreases the actual security of the system. And putting effort (no matter how cheap) into something that decreases the overall security - that's not a good idea regarding risk management.
- tghw 14y ago
  Not having the image provides even less certainty of security. You assume that the image being there will make people less likely to check other aspects of the site, like the URL. But consider the average user. Spoofing and phishing attacks work because people don't check these things. The security image is difficult to spoof and is more likely to clue average users in to attacks. Therefore, it is useful as a security device and is not worse than not having it.

by rwg 14y ago

vog 14y ago

> ... the security picture was probably cheap to implement ... Although the implementation might have been cheap, there's another factor to consider: If a system provides a false sense of security, this almost certainly decreases the actual security of the system. And putting effort (no matter how cheap) into something that decreases the overall security - that's not a good idea regarding risk management.

tghw 14y ago
Not having the image provides even less certainty of security. You assume that the image being there will make people less likely to check other aspects of the site, like the URL. But consider the average user. Spoofing and phishing attacks work because people don't check these things. The security image is difficult to spoof and is more likely to clue average users in to attacks. Therefore, it is useful as a security device and is not worse than not having it.