3 ms·

Applied to a population, the argument makes sense: 100 million users spent 1 minute/day verifying URLs --> cost of $33M of lost productivity (assume wage of $2

Applied to a population, the argument makes sense: 100 million users spent 1 minute/day verifying URLs --> cost of $33M of lost productivity (assume wage of $20/h) --> avoids 10,000 successful phishing attacks (.01% of population) --> saves $500K (each victim loses $500) --> not worth following security advice (since $33M is far greater than $500K) Applied at an individual level, the argument makes less sense: 1 user (i.e., me) spends 1 minute/day verifying URLs --> cost of $0.33 of lost productivity --> avoid .01% chance of phishing attack --> avoid .01% chance of loss of $500 --> but in the event I do get phished, my loss is $500 + WEEKS of hassle with banks, credit reporting agencies, etc, to clean up the mess! This is like the antibiotics trade-off. We don't want the population to overuse antibiotics to avoid building resistance in the population. But if I'm sick, and there's only a 10% chance that the antibiotic is useful (and 90% chance that my illness is viral and therefore the antibiotic is useless but otherwise harmless), then it's still in my individual interest to take it.

Domenic_S 11y ago
Interesting logic but bad conclusion -- why didn't you do the final calculation?!?! 1 minute/day verifying URLs --> cost of $0.33 of lost productivity --> avoid .01% chance of phishing attack --> avoid .01% chance of loss of $500 --> avoid a loss of $0.05 With these numbers, it never makes sense to verify URLs ($0.33 > $0.05). > my loss is $500 + WEEKS of hassle with banks, credit reporting agencies, etc, to clean up the mess! This is the rub IMO.. if it costs you $2,000 in time/lost wages/whatever to work through fixing it, it still only costs $0.25 total/day, ie still not worth it. If it costs $3,000, then it's worth it. > This is like the antibiotics trade-off. Not really - you saw "population" and made the connection, but it isn't there. In the antibiotics situation, there's a common resource - antibiotic effectiveness - that is slowly depleted as a member of the population partakes. It's in the population's interest to maintain the resource, and in the individual's interest to deplete it. This is called Tragedy of the Commons [0]. For security though there is no analogous common resource; my security practices as a user and yours aren't connected in that way. It's everyone for themselves. [0] https://en.wikipedia.org/wiki/Tragedy_of_the_commons https://en.wikipedia.org/wiki/Tragedy_of_the_commons
ubernostrum 11y ago
Careful there. In your fourth paragraph you include the lost time/money of cleaning up the theft. But in the second paragraph you don't. This means you're not actually comparing the two possibilities.
Lawtonfogle 11y ago
You account for the time hassle in one case but not the other. You need to account for it in both, with the population using the average value of time for that population. The end result is that it is likely worth it for some people whose time is worth more than for others. The only problem is the worth of time. Is a CEO making $200/hr missing their kid's baseball game really losing more than the $10/hr admin staff missing their kid's baseball game? >This is like the antibiotics trade-off. We don't want the population to overuse antibiotics to avoid building resistance in the population. But if I'm sick, and there's only a 10% chance that the antibiotic is useful (and 90% chance that my illness is viral and therefore the antibiotic is useless but otherwise harmless), then it's still in my individual interest to take it. I'm not sure this is all that related. For antibiotics, the problem is that someone else taking an antibiotic has a cost to you (in bacteria becoming more resistant). Thus, you taking it gets you a gain of 1000 at a cost of 1 but someone else taking it gets you a gain of 0 at a cost of 1. This is an example of everyone using a strategy that helps them at the cost of others, which is a strategy that does not scale well when trying to maximize the gain of the whole group. In the security example, if it is beneficial for the average person to use the 'increased security' strategy, then the strategy is a net benefit when scaled (if done so evenly across the population, which may be a faulty assumption). In short, security scales the benefit (or cost) evenly. k gain for 1 person, kn gain for n people. k Cost for 1 person, kn cost for n people. Antibiotics does not. (k - j) gain/cost for 1 person, n(k - nj) gain/cost for n people. Edit: To specify, the n(k - nj) is based on a person getting k benefit at j costs from using an antibiotic, while everyone else gets only j cost. So one use of an antibiotic is 1 person get k benefit while n people get j cost, or (k - nj). This is then multiplied by those n people each taking an antibiotic.

Domenic_S 11y ago

Interesting logic but bad conclusion -- why didn't you do the final calculation?!?! 1 minute/day verifying URLs --> cost of $0.33 of lost productivity --> avoid .01% chance of phishing attack --> avoid .01% chance of loss of $500 --> avoid a loss of $0.05 With these numbers, it never makes sense to verify URLs ($0.33 > $0.05). > my loss is $500 + WEEKS of hassle with banks, credit reporting agencies, etc, to clean up the mess! This is the rub IMO.. if it costs you $2,000 in time/lost wages/whatever to work through fixing it, it still only costs $0.25 total/day, ie still not worth it. If it costs $3,000, then it's worth it. > This is like the antibiotics trade-off. Not really - you saw "population" and made the connection, but it isn't there. In the antibiotics situation, there's a common resource - antibiotic effectiveness - that is slowly depleted as a member of the population partakes. It's in the population's interest to maintain the resource, and in the individual's interest to deplete it. This is called Tragedy of the Commons [0]. For security though there is no analogous common resource; my security practices as a user and yours aren't connected in that way. It's everyone for themselves. [0] https://en.wikipedia.org/wiki/Tragedy_of_the_commons https://en.wikipedia.org/wiki/Tragedy_of_the_commons

ubernostrum 11y ago

Careful there. In your fourth paragraph you include the lost time/money of cleaning up the theft. But in the second paragraph you don't. This means you're not actually comparing the two possibilities.

Lawtonfogle 11y ago

You account for the time hassle in one case but not the other. You need to account for it in both, with the population using the average value of time for that population. The end result is that it is likely worth it for some people whose time is worth more than for others. The only problem is the worth of time. Is a CEO making $200/hr missing their kid's baseball game really losing more than the $10/hr admin staff missing their kid's baseball game? >This is like the antibiotics trade-off. We don't want the population to overuse antibiotics to avoid building resistance in the population. But if I'm sick, and there's only a 10% chance that the antibiotic is useful (and 90% chance that my illness is viral and therefore the antibiotic is useless but otherwise harmless), then it's still in my individual interest to take it. I'm not sure this is all that related. For antibiotics, the problem is that someone else taking an antibiotic has a cost to you (in bacteria becoming more resistant). Thus, you taking it gets you a gain of 1000 at a cost of 1 but someone else taking it gets you a gain of 0 at a cost of 1. This is an example of everyone using a strategy that helps them at the cost of others, which is a strategy that does not scale well when trying to maximize the gain of the whole group. In the security example, if it is beneficial for the average person to use the 'increased security' strategy, then the strategy is a net benefit when scaled (if done so evenly across the population, which may be a faulty assumption). In short, security scales the benefit (or cost) evenly. k gain for 1 person, kn gain for n people. k Cost for 1 person, kn cost for n people. Antibiotics does not. (k - j) gain/cost for 1 person, n(k - nj) gain/cost for n people. Edit: To specify, the n(k - nj) is based on a person getting k benefit at j costs from using an antibiotic, while everyone else gets only j cost. So one use of an antibiotic is 1 person get k benefit while n people get j cost, or (k - nj). This is then multiplied by those n people each taking an antibiotic.