4 ms·

If there's anything we've learned from the last 20 years in security it's that the user is the least fit to decide. They are bad at passwords, they are bad at c

by mentat 11y ago

If there's anything we've learned from the last 20 years in security it's that the user is the least fit to decide. They are bad at passwords, they are bad at clicking things in email, they just are not security conscious. "Click here to trust my CA", how's that going to end?

IE6 11y ago
Agree - most users of computers do not know anything bout infosec nor do they care.
userbinator 11y ago
If anything that is an education problem, which is further compounded by the trend of wanting to turn users into completely passive entities who don't know or have to do anything, because then they are more easily controlled and manipulated. The industry does not encourage users to think and learn. The industry wants its software to do the thinking for them. It doesn't want users to think about trust at all. I think that is the scariest part of where things are heading.
- xenadu02 11y ago
  That's the great fallacy though. The amount of technical knowledge required to make truly informed security decisions is out of the question for 99% of all computer/mobile users. It isn't about being passive; it's about having lives and jobs and other things to do with their time. A heart surgeon may be a genius but he doesn't have time to keep up with the latest research and teach himself PKI, certificates, crypto, and permission models across all the platforms he uses (and keep up to date on those too!) Users will not waste their time thinkin about trust. The history of our industry is ample evidence that it would be a losing battle. Not to mention a single mistake can be ruinous, requiring absolute perfection 100% of the time (from users and programmers).
  - nitrogen 11y ago
    Not to mention a single mistake can be ruinous, requiring absolute perfection 100% of the time (from users and programmers). One can hope that, eventually, formally mathematically verified open source systems will help solve the issue, at least on the programming side.
    - namplaa 11y ago
      I doubt the halting problem will be solved.
      - nitrogen 11y ago
        The solution to the halting problem is to stop building universal/Turing-complete machines. Edit: since this was downvoted, I will elaborate. The halting problem only applies to arbitrary programs on Turing-complete systems. It is possible to create useful systems that are not Turing complete. As a baseline example, it is easy to tell that the following Ruby program halts: exit Problems arise when one allows unbounded loops and unbounded recursion. If all loops and all recursions are provably finite, then a program can be proven to exit. All sorts of useful things can be done with systems composed of small, provably terminating programs. And it turns out, the vast majority (if not all) of the things relevant to securing a computer system can be implemented in formally provable ways.
- nitrogen 11y ago
  Users in the past had every opportunity to think and learn, and their failure to do so is why we are where we are today. I mean, there are still people who refuse to wear seatbelts or vaccinate their children... How can we ever expect people to understand all the moving parts in a secure computer system?
pdkl95 11y ago
14% of adult Americans (about 30M people) are functionally illiterate[1]. They are bad at reading things in snailmail, many just don't see the value in it. We have records, stories, and even myths that seek to warn people about the disreputable men who take advantage of their mark's ignorance. Does society try to keep these people illiterate? Does we give up, accuse the millions of illiterate people of not caring, and find ways to hide important things from them? Do we simply let them stay ignorant while making sure we hide any books when they are around, because books when they are around "because they don't care"? While I'm sure there have been been people who have done these things, we - as a modern society - generally find the idea of being illiterate to be a serious problem; serious enough that we spend significant amounts of money on education programs and other attempts to fix the problem of illiteracy. Technology has created a new literacy. I'm not talking about programming or suggesting that people need to know HTML or anything. However, if you want to function in modern society, you need to understand some of the evolving language that society uses. This new literacy includes things like understanding that strings of the form "xxx@yyy.zzz" are probably an email address, and when you read something that starts "http://" http://" or ends in ".com" or ".net" is probably referring to a website. The fact that the educational system has yet to catch up to the changes in technology is not a reason to force decisions on people, nor is it a reason to accuse them of not caring; instead, we should be interpreting the problems people have with security as a sign that a lot more education is needed, and we need to find ways to help people learn so they can protect themselves. Unfortunately, there are a lot of people in the tech community that are confusing "frustration at not understanding obtuse technology" with "not caring about security". Many people do care, but lack the slightest idea about how to even approach important technical decisions. Certificates, keys, signing, and the like are not what matters, and are minutia tha should be left to those with proper technical knowledge. What matters in security is where the trust is being placed, and that is something a lot of people are skilled at. Obviously, change isn't going to happen overnight. My suggestion is that we need a way to let people at least start down that path of managing trust. A good first step would be simply exposing the process so people can learn that a trust decision is even necessary. [1] functionally illiterate is defined as those adults with a reading level below the basic requirements necessary to "perform simple and everyday literacy activities". Data is from https://nces.ed.gov/naal/kf_demographics.asp https://nces.ed.gov/naal/kf_demographics.asp
jessaustin 11y ago
They are bad at passwords... That's like saying they are bad at juggling with one hand while riding a unicycle. Passwords are the bad thing, and users have been subjected to them for quite long enough.
threeseed 11y ago
Case in point: users handing over passwords: https://www.youtube.com/watch?v=opRMrEfAIiI https://www.youtube.com/watch?v=opRMrEfAIiI

by mentat 11y ago

IE6 11y ago

Agree - most users of computers do not know anything bout infosec nor do they care.

userbinator 11y ago

If anything that is an education problem, which is further compounded by the trend of wanting to turn users into completely passive entities who don't know or have to do anything, because then they are more easily controlled and manipulated. The industry does not encourage users to think and learn. The industry wants its software to do the thinking for them. It doesn't want users to think about trust at all. I think that is the scariest part of where things are heading.

xenadu02 11y ago
That's the great fallacy though. The amount of technical knowledge required to make truly informed security decisions is out of the question for 99% of all computer/mobile users. It isn't about being passive; it's about having lives and jobs and other things to do with their time. A heart surgeon may be a genius but he doesn't have time to keep up with the latest research and teach himself PKI, certificates, crypto, and permission models across all the platforms he uses (and keep up to date on those too!) Users will not waste their time thinkin about trust. The history of our industry is ample evidence that it would be a losing battle. Not to mention a single mistake can be ruinous, requiring absolute perfection 100% of the time (from users and programmers).
- nitrogen 11y ago
  Not to mention a single mistake can be ruinous, requiring absolute perfection 100% of the time (from users and programmers). One can hope that, eventually, formally mathematically verified open source systems will help solve the issue, at least on the programming side.
  - namplaa 11y ago
    I doubt the halting problem will be solved.
    - nitrogen 11y ago
      The solution to the halting problem is to stop building universal/Turing-complete machines. Edit: since this was downvoted, I will elaborate. The halting problem only applies to arbitrary programs on Turing-complete systems. It is possible to create useful systems that are not Turing complete. As a baseline example, it is easy to tell that the following Ruby program halts: exit Problems arise when one allows unbounded loops and unbounded recursion. If all loops and all recursions are provably finite, then a program can be proven to exit. All sorts of useful things can be done with systems composed of small, provably terminating programs. And it turns out, the vast majority (if not all) of the things relevant to securing a computer system can be implemented in formally provable ways.
nitrogen 11y ago
Users in the past had every opportunity to think and learn, and their failure to do so is why we are where we are today. I mean, there are still people who refuse to wear seatbelts or vaccinate their children... How can we ever expect people to understand all the moving parts in a secure computer system?

pdkl95 11y ago

14% of adult Americans (about 30M people) are functionally illiterate[1]. They are bad at reading things in snailmail, many just don't see the value in it. We have records, stories, and even myths that seek to warn people about the disreputable men who take advantage of their mark's ignorance. Does society try to keep these people illiterate? Does we give up, accuse the millions of illiterate people of not caring, and find ways to hide important things from them? Do we simply let them stay ignorant while making sure we hide any books when they are around, because books when they are around "because they don't care"? While I'm sure there have been been people who have done these things, we - as a modern society - generally find the idea of being illiterate to be a serious problem; serious enough that we spend significant amounts of money on education programs and other attempts to fix the problem of illiteracy. Technology has created a new literacy. I'm not talking about programming or suggesting that people need to know HTML or anything. However, if you want to function in modern society, you need to understand some of the evolving language that society uses. This new literacy includes things like understanding that strings of the form "xxx@yyy.zzz" are probably an email address, and when you read something that starts "http://" http://" or ends in ".com" or ".net" is probably referring to a website. The fact that the educational system has yet to catch up to the changes in technology is not a reason to force decisions on people, nor is it a reason to accuse them of not caring; instead, we should be interpreting the problems people have with security as a sign that a lot more education is needed, and we need to find ways to help people learn so they can protect themselves. Unfortunately, there are a lot of people in the tech community that are confusing "frustration at not understanding obtuse technology" with "not caring about security". Many people do care, but lack the slightest idea about how to even approach important technical decisions. Certificates, keys, signing, and the like are not what matters, and are minutia tha should be left to those with proper technical knowledge. What matters in security is where the trust is being placed, and that is something a lot of people are skilled at. Obviously, change isn't going to happen overnight. My suggestion is that we need a way to let people at least start down that path of managing trust. A good first step would be simply exposing the process so people can learn that a trust decision is even necessary. [1] functionally illiterate is defined as those adults with a reading level below the basic requirements necessary to "perform simple and everyday literacy activities". Data is from https://nces.ed.gov/naal/kf_demographics.asp https://nces.ed.gov/naal/kf_demographics.asp

jessaustin 11y ago

They are bad at passwords... That's like saying they are bad at juggling with one hand while riding a unicycle. Passwords are the bad thing, and users have been subjected to them for quite long enough.

threeseed 11y ago

Case in point: users handing over passwords: https://www.youtube.com/watch?v=opRMrEfAIiI https://www.youtube.com/watch?v=opRMrEfAIiI