3 ms·

Instead of giving them an advice, we who understand how it works should make these things defaults and not let them exposed. What can the users do in a world wh

Instead of giving them an advice, we who understand how it works should make these things defaults and not let them exposed. What can the users do in a world where banks are asking you to read the CC details loudly in a phone conversation and give them all the details over the phone. Next thing is that there is a fake call from a criminal organization pretending to be the bank. How would a user detect that it is fake? I think security should be about rules and enforced practices rather than advices that they can happily ignore.

GhotiFish 11y ago
>How would a user detect that it is fake? I use challenge response. They ask a question, you give them the wrong answer, they confirm that it's wrong. You and the banks have shared secrets.
- cortesoft 11y ago
  What is to stop the bad guy from calling the bank at the same time they call you, and passing your challenge and responses on to the bank teller?
  - dublinben 11y ago
    Nothing. This is a classic MITM attack. Only out of band verification or a preshared secret would prevent that.
Anderkent 11y ago
> Instead of giving them an advice, we who understand how it works should make these things defaults and not let them exposed. This is missing the point. The article states the security advice is actively harmful, in that applying it is more costly than the expected returns warrant. Just enforcing those costs on users doesn't help.
- istvan__ 11y ago
  Yes I was just pointing out that not only the advice giving part is bad but also the practices that even banks follow today are harmful.
schrodinger 11y ago
Also, even if I did get taken by a criminal organization pretending to be the bank, I'm going to get the money back anyway once I report fraudulent charges. Not much risk on my end…