Text 2011, 444 rader
Skriven 2005-01-17 09:30:28 av Rich (1:379/45)
Kommentar till text 2009 av Geo (1:379/45)
Ärende: Re: Do we protect users from their own stupidity?
=========================================================
From: "Rich" <@>
This is a multi-part message in MIME format.
------=_NextPart_000_0755_01C4FC77.2EF80350
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
You really are living in some other world if you think that =
displaying the RFC822 headers for an email message by default would be =
perceived as anything but garbage to be ignored by most users.
Rich
"Geo" <georger@nls.net> wrote in message news:41eb9f58@w3.nls.net...
People fall prey to phishing attacks because outlook shows them the =
text name instead of the real email address and because it doesn't show = them
the headers.
Back when I started doing email, the email programs by default showed =
all the headers and it made me aware that this information was there, it =
caused me to ask what it means. Today email programs hide all the = information
that is useful in telling the real source of an email. Even = the feature that
allows you to see this information is hidden away in = today's email programs.
This is one of the reasons phishing attacks are successful, the other =
is that you can't trust the address bar. And yes, I have been fooled by = the
address bar and by my email program showing a false name in the from = field
and also by links that show one site but actually link to another. = This is
one of the reasons I choose to view all my email as plain text = instead of
html.
Geo.
"Rich" <@> wrote in message news:41eaf508@w3.nls.net...
I disagree.
People do very much know the difference between their own =
computer and the other computers referenced in phishing attacks. They = know
that email comes from somewhere outside their computer. They know = the web
site to which they are referred is not their computer. They = still are
fooled.
People know they are choosing to download and install software =
from the Internet. What they may not know is that it is or contains = spyware.
There is no confusion over boundaries.
I believe your whole idea of trust is off base. People aren't =
making decisions on whether or not to trust particular machines. I = douby
very much most people even think that way. People place trust in = other
people or in some cases who they believe those people are. = Phishing attacks
for bank sites succeed because the people the fall pray = to them believe that
the people sending the email are valid = representitives of the bank and they
trust those people.
As for your initial premise, I honestly don't know what it is you =
believe is consistent that should not be or is different that should not = be.
You can't be referring to the browser which is almost never used = for the
local computer and clearly identifies what is local and what is = not.
Your claim regarding phishing is also wrong. The address bar is =
one possible indicator to users. Phishing attacks preceeded any of = these and
continue without them. I've seen phishing emails that make no = attempt to
mask the domain to which they refer. People still get = fooled. The address
bar probably means little to many users. I can = tell when speaking with and
helping non-technical users that even though = they get that they type into the
address bar to go to a site they do not = always get that it is overloaded to
provide feedback to them where they = have gone. The same with the status bar.
Their have been status bar = spoofs. They make little difference. Do any of
these make a difference = to you so that you would be fooled?
Rich
"Geo" <georger@nls.net> wrote in message =
news:41ea4440@w3.nls.net...
part of the reason it's so easy to fool people is because of =
Microsoft. Remember some years ago when I said to make a consistant = interface
that blurs the line between the local machine and remote = machines/internet
machines was a mistake? Well that's one of the big = reasons why people today
are so easy to fool. They don't understand the = concept of trusted/untrusted
machines because it all looks the same to = them. They honestly don't know
where their machine ends and the rest of = the world begins.
I understood the logic behind making that a consistent interface =
and blurring the line but I saw the problem with it as well. How is a = user to
know the difference between a remote website and a help page = from one of
their own programs if there is no difference?
As for not knowing anyone who was infected due to the exploit of a =
bug, doesn't phishing work because of a bug that allows IE to show one =
address in the address bar while in fact it's talking to another = address?
What, doesn't that count?
Geo.
"Rich" <@> wrote in message news:41e9f4ea$1@w3.nls.net...
You can't protect them from their own stupidity. I've seen =
plenty of examples of people getting infected with spyware due to their = own
explicit actions, either approving when asked if something should be =
installed or explicitly downloading and installing something that is or =
includes spyware. I do not know of anyone personally that was infected = due
to an exploit of a bug. Phishing is another example that relies = almost
entirely on people being to trusting and doing something they = shouldn't. I
haven't seen an email virus in a long time that did not = rely on the user
following instructions in the email to act against his = own interest and run
or even save then open and run something they = shouldn't. We are well beyond
what many folks would consider security. = To protect against people making
these kinds of mistakes you have to = take choices they can't be trusted making
away from them. That upsets = the folks that can be trusted to or want to make
these choices unhappy. = This isn't far from the idea that putting you in a
straightjacket makes = you more secure because you are less likely to hurt
yourself. As for = how people react to this, do you remember the reaction to
cars that = buzzed or otherwise made noise when the driver or a passenger did
not = wear his seat belt? It wasn't positive.
Rich
"Ellen K." <72322.enno.esspeayem.1016@compuserve.com> wrote in =
message news:48qju0547j4l00akdf69j0bip7fgj8bmp5@4ax.com...
And that is a very big problem when trying to figure out what =
security
features should be built in or what functionality should be =
allowed. Do
we protect users from their own stupidity? I guess there is =
a
rationale for doing so in that if the masses' machines are =
laxly secured
(if at all), the danger to _everyone_ increases.
On Mon, 10 Jan 2005 15:07:12 -0800, "Rich" <@> wrote in =
message
<41e30a96@w3.nls.net>:
> I agree there are a great many people that have no =
interest in or familiarity with exercising the control available to = them.
That will always be true. =20
>
>Rich
>
> "Ellen K." <72322.enno.esspeayem.1016@compuserve.com> wrote =
in message news:7og4u0pj8f0nq10sm8t2covkac7q75oj1s@4ax.com...
> Well, I think this conversation is all over the place =
regarding who we
> are talking about when we talk about users. The folks here =
are an
> entirely different animal from the famous great unwashed =
masses.
>
> On Sun, 9 Jan 2005 01:40:28 -0800, "Rich" <@> wrote in =
message
> <41e0fbe8@w3.nls.net>:
>
> > Because you are in control, my point to george.
> >
> >Rich
------=_NextPart_000_0755_01C4FC77.2EF80350
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=3DContent-Type content=3D"text/html; =
charset=3Diso-8859-1">
<META content=3D"MSHTML 6.00.3790.1289" name=3DGENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=3D#ffffff>
<DIV><FONT face=3DArial size=3D2> You really are living in =
some other=20
world if you think that displaying the RFC822 headers for an email = message
by=20
default would be perceived as anything but garbage to be ignored by =
most=20
users.</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2>Rich</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<BLOCKQUOTE dir=3Dltr=20
style=3D"PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; =
BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV>"Geo" <<A =
href=3D"mailto:georger@nls.net">georger@nls.net</A>> wrote=20
in message <A=20
=
href=3D"news:41eb9f58@w3.nls.net">news:41eb9f58@w3.nls.net</A>...</DIV>
<DIV><FONT face=3DArial size=3D2>People fall prey to phishing attacks =
because=20
outlook shows them the text name instead of the real email address and =
because=20
it doesn't show them the headers.</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2>Back when I started doing email, the =
email=20
programs by default showed all the headers and it made me aware that =
this=20
information was there, it caused me to ask what it means. Today email =
programs=20
hide all the information that is useful in telling the real source of =
an=20
email. Even the feature that allows you to see this information is =
hidden away=20
in today's email programs.</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2>This is one of the reasons phishing =
attacks are=20
successful, the other is that you can't trust the address bar. And =
yes, I have=20
been fooled by the address bar and by my email program showing a false =
name in=20
the from field and also by links that show one site but actually link =
to=20
another. This is one of the reasons I choose to view all my email as =
plain=20
text instead of html.</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2>Geo.</FONT></DIV>
<BLOCKQUOTE dir=3Dltr=20
style=3D"PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; =
BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV>"Rich" <@> wrote in message <A=20
=
href=3D"news:41eaf508@w3.nls.net">news:41eaf508@w3.nls.net</A>...</DIV>
<DIV><FONT face=3DArial size=3D2> I =
disagree.</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2> People do very much =
know the=20
difference between their own computer and the other computers =
referenced in=20
phishing attacks. They know that email comes from somewhere =
outside=20
their computer. They know the web site to which they are =
referred is=20
not their computer. They still are fooled.</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2> People know they are=20
choosing to download and install software from the =
Internet. What=20
they may not know is that it is or contains spyware. There is =
no=20
confusion over boundaries.</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2> I believe your whole =
idea of trust=20
is off base. People aren't making decisions on whether or not =
to trust=20
particular machines. I douby very much most people even think =
that=20
way. People place trust in other people or in some cases who =
they=20
believe those people are. Phishing attacks for bank sites =
succeed=20
because the people the fall pray to them believe that the people =
sending the=20
email are valid representitives of the bank and they trust those=20
people.</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2> As for your initial =
premise, I=20
honestly don't know what it is you believe is consistent that should =
not be=20
or is different that should not be. You can't be referring to =
the=20
browser which is almost never used for the local computer and =
clearly=20
identifies what is local and what is not.</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2> Your claim regarding =
phishing is=20
also wrong. The address bar is one possible indicator to =
users. =20
Phishing attacks preceeded any of these and continue without =
them. =20
I've seen phishing emails that make no attempt to mask the domain to =
which=20
they refer. People still get fooled. The address bar =
probably=20
means little to many users. I can tell when speaking with and =
helping=20
non-technical users that even though they get that they type into =
the=20
address bar to go to a site they do not always get that it is =
overloaded to=20
provide feedback to them where they have gone. The same with =
the=20
status bar. Their have been status bar spoofs. They make =
little=20
difference. Do any of these make a difference to you so that =
you would=20
be fooled?</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2>Rich</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<BLOCKQUOTE dir=3Dltr=20
style=3D"PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; =
BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV>"Geo" <<A =
href=3D"mailto:georger@nls.net">georger@nls.net</A>>=20
wrote in message <A=20
=
href=3D"news:41ea4440@w3.nls.net">news:41ea4440@w3.nls.net</A>...</DIV>
<DIV><FONT face=3DArial size=3D2>part of the reason it's so easy =
to fool=20
people is because of Microsoft. Remember some years ago when I =
said to=20
make a consistant interface that blurs the line between the local =
machine=20
and remote machines/internet machines was a mistake? Well that's =
one of=20
the big reasons why people today are so easy to fool. They don't=20
understand the concept of trusted/untrusted machines because it =
all looks=20
the same to them. They honestly don't know where their machine =
ends and=20
the rest of the world begins.</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2>I understood the logic behind =
making that a=20
consistent interface and blurring the line but I saw the problem =
with it=20
as well. How is a user to know the difference between a remote =
website and=20
a help page from one of their own programs if there is no=20
difference?</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2>As for not knowing anyone who was =
infected=20
due to the exploit of a bug, doesn't phishing work because of a =
bug that=20
allows IE to show one address in the address bar while in fact =
it's=20
talking to another address? What, doesn't that count?</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2>Geo.</FONT></DIV>
<BLOCKQUOTE dir=3Dltr=20
style=3D"PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; =
BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV>"Rich" <@> wrote in message <A=20
=
href=3D"news:41e9f4ea$1@w3.nls.net">news:41e9f4ea$1@w3.nls.net</A>...</DI=
V>
<DIV><FONT face=3DArial size=3D2> You can't protect =
them from=20
their own stupidity. I've seen plenty of examples of =
people=20
getting infected with spyware due to their own explicit actions, =
either=20
approving when asked if something should be installed or =
explicitly=20
downloading and installing something that is or includes =
spyware. =20
I do not know of anyone personally that was infected due to an =
exploit=20
of a bug. Phishing is another example that relies almost =
entirely=20
on people being to trusting and doing something they =
shouldn't. I=20
haven't seen an email virus in a long time that did not =
rely on the=20
user following instructions in the email to act against his own =
interest=20
and run or even save then open and run something they =
shouldn't. =20
We are well beyond what many folks would consider =
security. To=20
protect against people making these kinds of mistakes you have =
to take=20
choices they can't be trusted making away from them. That =
upsets=20
the folks that can be trusted to or want to make these choices=20
unhappy. This isn't far from the idea that putting you in =
a=20
straightjacket makes you more secure because you are less likely =
to hurt=20
yourself. As for how people react to this, do you remember =
the=20
reaction to cars that buzzed or otherwise made noise when the =
driver or=20
a passenger did not wear his seat belt? It wasn't=20
positive.</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2>Rich</FONT></DIV>
<BLOCKQUOTE=20
style=3D"PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: =
5px; BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV>"Ellen K." <<A=20
=
href=3D"mailto:72322.enno.esspeayem.1016@compuserve.com">72322.enno.esspe=
ayem.1016@compuserve.com</A>>=20
wrote in message <A=20
=
href=3D"news:48qju0547j4l00akdf69j0bip7fgj8bmp5@4ax.com">news:48qju0547j4=
l00akdf69j0bip7fgj8bmp5@4ax.com</A>...</DIV>And=20
that is a very big problem when trying to figure out what=20
security<BR>features should be built in or what functionality =
should=20
be allowed. Do<BR>we protect users from their own=20
stupidity? I guess there is a<BR>rationale for =
doing so in=20
that if the masses' machines are laxly secured<BR>(if at all), =
the=20
danger to _everyone_ increases.<BR><BR>On Mon, 10 Jan 2005 =
15:07:12=20
-0800, "Rich" <@> wrote in message<BR><<A=20
=
href=3D"mailto:41e30a96@w3.nls.net">41e30a96@w3.nls.net</A>>:<BR><BR>&=
gt; =20
I agree there are a great many people that have no interest in =
or=20
familiarity with exercising the control available to =
them. That=20
will always be true. =
<BR>><BR>>Rich<BR>><BR>> =20
"Ellen K." <<A=20
=
href=3D"mailto:72322.enno.esspeayem.1016@compuserve.com">72322.enno.esspe=
ayem.1016@compuserve.com</A>>=20
wrote in message <A=20
=
href=3D"news:7og4u0pj8f0nq10sm8t2covkac7q75oj1s@4ax.com">news:7og4u0pj8f0=
nq10sm8t2covkac7q75oj1s@4ax.com</A>...<BR>> =20
Well, I think this conversation is all over the place =
regarding who=20
we<BR>> are talking about when we talk about =
users. The=20
folks here are an<BR>> entirely different animal from =
the=20
famous great unwashed masses.<BR>><BR>> On Sun, 9 =
Jan 2005=20
01:40:28 -0800, "Rich" <@> wrote in =
message<BR>> <<A=20
=
href=3D"mailto:41e0fbe8@w3.nls.net">41e0fbe8@w3.nls.net</A>>:<BR>><=
BR>> =20
> Because you are in control, my point to=20
george.<BR>> ><BR>> =20
=
>Rich<BR></BLOCKQUOTE></BLOCKQUOTE></BLOCKQUOTE></BLOCKQUOTE></BLOCKQU=
OTE></BODY></HTML>
------=_NextPart_000_0755_01C4FC77.2EF80350--
--- BBBS/NT v4.01 Flag-5
* Origin: Barktopia BBS Site http://HarborWebs.com:8081 (1:379/45)
|