Tillbaka till svenska Fidonet
English   Information   Debug  
OS2BBS   0/787
OS2DOSBBS   0/580
OS2HW   0/42
OS2INET   0/37
OS2LAN   0/134
OS2PROG   0/36
OS2REXX   0/113
OS2USER-L   207
OS2   0/4786
OSDEBATE   2118/18996
PASCAL   0/490
PERL   0/457
PHP   0/45
POINTS   0/405
POLITICS   0/29554
POL_INC   0/14731
PSION   103
R20_ADMIN   1121
R20_AMATORRADIO   0/2
R20_BEST_OF_FIDONET   13
R20_CHAT   0/893
R20_DEPP   0/3
R20_DEV   399
R20_ECHO2   1379
R20_ECHOPRES   0/35
R20_ESTAT   0/719
R20_FIDONETPROG...
...RAM.MYPOINT
  0/2
R20_FIDONETPROGRAM   0/22
R20_FIDONET   0/248
R20_FILEFIND   0/24
R20_FILEFOUND   0/22
R20_HIFI   0/3
R20_INFO2   3206
R20_INTERNET   0/12940
R20_INTRESSE   0/60
R20_INTR_KOM   0/99
R20_KANDIDAT.CHAT   42
R20_KANDIDAT   28
R20_KOM_DEV   112
R20_KONTROLL   0/13259
R20_KORSET   0/18
R20_LOKALTRAFIK   0/24
R20_MODERATOR   0/1852
R20_NC   76
R20_NET200   245
R20_NETWORK.OTH...
...ERNETS
  0/13
R20_OPERATIVSYS...
...TEM.LINUX
  0/44
R20_PROGRAMVAROR   0/1
R20_REC2NEC   534
R20_SFOSM   0/340
R20_SF   0/108
R20_SPRAK.ENGLISH   0/1
R20_SQUISH   107
R20_TEST   2
R20_WORST_OF_FIDONET   12
RAR   0/9
RA_MULTI   106
RA_UTIL   0/162
REGCON.EUR   0/2056
REGCON   0/13
SCIENCE   0/1206
SF   0/239
SHAREWARE_SUPPORT   0/5146
SHAREWRE   0/14
SIMPSONS   0/169
STATS_OLD1   0/2539.065
STATS_OLD2   0/2530
STATS_OLD3   0/2395.095
STATS_OLD4   0/1692.25
SURVIVOR   440/495
SYSOPS_CORNER   0/3
SYSOP   0/84
TAGLINES   0/112
TEAMOS2   0/4530
TECH   0/2617
TEST.444   0/105
TRAPDOOR   0/19
TREK   0/755
TUB   0/290
UFO   0/40
UNIX   0/1316
USA_EURLINK   0/102
USR_MODEMS   0/1
VATICAN   0/2740
VIETNAM_VETS   0/14
VIRUS   0/378
VIRUS_INFO   0/201
VISUAL_BASIC   0/473
WHITEHOUSE   0/5187
WIN2000   0/101
WIN32   0/30
WIN95   0/4288
WIN95_OLD1   0/70272
WINDOWS   0/1517
WWB_SYSOP   0/419
WWB_TECH   0/810
ZCC-PUBLIC   0/1
ZEC   4

 
4DOS   0/134
ABORTION   0/7
ALASKA_CHAT   0/506
ALLFIX_FILE   0/1313
ALLFIX_FILE_OLD1   0/7997
ALT_DOS   0/152
AMATEUR_RADIO   0/1039
AMIGASALE   0/14
AMIGA   0/331
AMIGA_INT   0/1
AMIGA_PROG   0/20
AMIGA_SYSOP   0/26
ANIME   0/15
ARGUS   0/924
ASCII_ART   0/340
ASIAN_LINK   0/651
ASTRONOMY   0/417
AUDIO   0/92
AUTOMOBILE_RACING   0/105
BABYLON5   0/17862
BAG   135
BATPOWER   0/361
BBBS.ENGLISH   0/382
BBSLAW   0/109
BBS_ADS   0/5290
BBS_INTERNET   0/507
BIBLE   0/3563
BINKD   0/1119
BINKLEY   0/215
BLUEWAVE   0/2173
CABLE_MODEMS   0/25
CBM   0/46
CDRECORD   0/66
CDROM   0/20
CLASSIC_COMPUTER   0/378
COMICS   0/15
CONSPRCY   0/899
COOKING   32689
COOKING_OLD1   0/24719
COOKING_OLD2   0/40862
COOKING_OLD3   0/37489
COOKING_OLD4   0/35496
COOKING_OLD5   9370
C_ECHO   0/189
C_PLUSPLUS   0/31
DIRTY_DOZEN   0/201
DOORGAMES   0/2053
DOS_INTERNET   0/196
duplikat   6002
ECHOLIST   0/18295
EC_SUPPORT   0/318
ELECTRONICS   0/359
ELEKTRONIK.GER   1534
ENET.LINGUISTIC   0/13
ENET.POLITICS   0/4
ENET.SOFT   0/11701
ENET.SYSOP   33888
ENET.TALKS   0/32
ENGLISH_TUTOR   0/2000
EVOLUTION   0/1335
FDECHO   0/217
FDN_ANNOUNCE   0/7068
FIDONEWS   24099
FIDONEWS_OLD1   0/49742
FIDONEWS_OLD2   0/35949
FIDONEWS_OLD3   0/30874
FIDONEWS_OLD4   0/37224
FIDO_SYSOP   12852
FIDO_UTIL   0/180
FILEFIND   0/209
FILEGATE   0/212
FILM   0/18
FNEWS_PUBLISH   4393
FN_SYSOP   41678
FN_SYSOP_OLD1   71952
FTP_FIDO   0/2
FTSC_PUBLIC   0/13598
FUNNY   0/4886
GENEALOGY.EUR   0/71
GET_INFO   105
GOLDED   0/408
HAM   0/16069
HOLYSMOKE   0/6791
HOT_SITES   0/1
HTMLEDIT   0/71
HUB203   466
HUB_100   264
HUB_400   39
HUMOR   0/29
IC   0/2851
INTERNET   0/424
INTERUSER   0/3
IP_CONNECT   719
JAMNNTPD   0/233
JAMTLAND   0/47
KATTY_KORNER   0/41
LAN   0/16
LINUX-USER   0/19
LINUXHELP   0/1155
LINUX   0/22090
LINUX_BBS   0/957
mail   18.68
mail_fore_ok   249
MENSA   0/341
MODERATOR   0/102
MONTE   0/992
MOSCOW_OKLAHOMA   0/1245
MUFFIN   0/783
MUSIC   0/321
N203_STAT   924
N203_SYSCHAT   313
NET203   321
NET204   69
NET_DEV   0/10
NORD.ADMIN   0/101
NORD.CHAT   0/2572
NORD.FIDONET   189
NORD.HARDWARE   0/28
NORD.KULTUR   0/114
NORD.PROG   0/32
NORD.SOFTWARE   0/88
NORD.TEKNIK   0/58
NORD   0/453
OCCULT_CHAT   0/93
Möte OSDEBATE, 18996 texter
 lista första sista föregående nästa
Text 1999, 344 rader
Skriven 2005-01-16 15:14:00 av Rich (1:379/45)
   Kommentar till text 1987 av Geo (1:379/45)
Ärende: Re: Do we protect users from their own stupidity?
=========================================================
From: "Rich" <@>

This is a multi-part message in MIME format.

------=_NextPart_000_06ED_01C4FBDE.025E1C10
Content-Type: text/plain;
        charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

   I disagree.

   People do very much know the difference between their own computer =
and the other computers referenced in phishing attacks.  They know that = email
comes from somewhere outside their computer.  They know the web = site to which
they are referred is not their computer.  They still are = fooled.

   People know they are choosing to download and install software from =
the Internet.  What they may not know is that it is or contains spyware. =
 There is no confusion over boundaries.

   I believe your whole idea of trust is off base.  People aren't making =
decisions on whether or not to trust particular machines.  I douby very = much
most people even think that way.  People place trust in other = people or in
some cases who they believe those people are.  Phishing = attacks for bank
sites succeed because the people the fall pray to them = believe that the
people sending the email are valid representitives of = the bank and they trust
those people.

   As for your initial premise, I honestly don't know what it is you =
believe is consistent that should not be or is different that should not = be. 
You can't be referring to the browser which is almost never used = for the
local computer and clearly identifies what is local and what is = not.

   Your claim regarding phishing is also wrong.  The address bar is one =
possible indicator to users.  Phishing attacks preceeded any of these = and
continue without them.  I've seen phishing emails that make no = attempt to
mask the domain to which they refer.  People still get = fooled.  The address
bar probably means little to many users.  I can = tell when speaking with and
helping non-technical users that even though = they get that they type into the
address bar to go to a site they do not = always get that it is overloaded to
provide feedback to them where they = have gone.  The same with the status bar.
 Their have been status bar = spoofs.  They make little difference.  Do any of
these make a difference = to you so that you would be fooled?

Rich

  "Geo" <georger@nls.net> wrote in message news:41ea4440@w3.nls.net...
  part of the reason it's so easy to fool people is because of =
Microsoft. Remember some years ago when I said to make a consistant = interface
that blurs the line between the local machine and remote = machines/internet
machines was a mistake? Well that's one of the big = reasons why people today
are so easy to fool. They don't understand the = concept of trusted/untrusted
machines because it all looks the same to = them. They honestly don't know
where their machine ends and the rest of = the world begins.

  I understood the logic behind making that a consistent interface and =
blurring the line but I saw the problem with it as well. How is a user = to
know the difference between a remote website and a help page from one = of
their own programs if there is no difference?

  As for not knowing anyone who was infected due to the exploit of a =
bug, doesn't phishing work because of a bug that allows IE to show one =
address in the address bar while in fact it's talking to another = address?
What, doesn't that count?

  Geo.
    "Rich" <@> wrote in message news:41e9f4ea$1@w3.nls.net...
       You can't protect them from their own stupidity.  I've seen =
plenty of examples of people getting infected with spyware due to their = own
explicit actions, either approving when asked if something should be =
installed or explicitly downloading and installing something that is or =
includes spyware.  I do not know of anyone personally that was infected = due
to an exploit of a bug.  Phishing is another example that relies = almost
entirely on people being to trusting and doing something they = shouldn't.  I
haven't seen an email virus in a long time that did not = rely on the user
following instructions in the email to act against his = own interest and run
or even save then open and run something they = shouldn't.  We are well beyond
what many folks would consider security.  = To protect against people making
these kinds of mistakes you have to = take choices they can't be trusted making
away from them.  That upsets = the folks that can be trusted to or want to make
these choices unhappy.  = This isn't far from the idea that putting you in a
straightjacket makes = you more secure because you are less likely to hurt
yourself.  As for = how people react to this, do you remember the reaction to
cars that = buzzed or otherwise made noise when the driver or a passenger did
not = wear his seat belt?  It wasn't positive.

    Rich
      "Ellen K." <72322.enno.esspeayem.1016@compuserve.com> wrote in =
message news:48qju0547j4l00akdf69j0bip7fgj8bmp5@4ax.com...
      And that is a very big problem when trying to figure out what =
security
      features should be built in or what functionality should be =
allowed.  Do
      we protect users from their own stupidity?   I guess there is a
      rationale for doing so in that if the masses' machines are laxly =
secured
      (if at all), the danger to _everyone_ increases.

      On Mon, 10 Jan 2005 15:07:12 -0800, "Rich" <@> wrote in message
      <41e30a96@w3.nls.net>:

      >   I agree there are a great many people that have no interest in =
or familiarity with exercising the control available to them.  That will =
always be true. =20
      >
      >Rich
      >
      >  "Ellen K." <72322.enno.esspeayem.1016@compuserve.com> wrote in =
message news:7og4u0pj8f0nq10sm8t2covkac7q75oj1s@4ax.com...
      >  Well, I think this conversation is all over the place regarding =
who we
      >  are talking about when we talk about users.  The folks here are =
an
      >  entirely different animal from the famous great unwashed =
masses.
      >
      >  On Sun, 9 Jan 2005 01:40:28 -0800, "Rich" <@> wrote in message
      >  <41e0fbe8@w3.nls.net>:
      >
      >  >   Because you are in control, my point to george.
      >  >
      >  >Rich

------=_NextPart_000_06ED_01C4FBDE.025E1C10
Content-Type: text/html;
        charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=3DContent-Type content=3D"text/html; =
charset=3Diso-8859-1">
<META content=3D"MSHTML 6.00.3790.1289" name=3DGENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=3D#ffffff>
<DIV><FONT face=3DArial size=3D2>&nbsp;&nbsp; I disagree.</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT>&nbsp;</DIV>
<DIV><FONT face=3DArial size=3D2>&nbsp;&nbsp; People do very much know =
the=20
difference between their own computer and the other computers referenced =
in=20
phishing attacks.&nbsp; They know that email comes from somewhere = outside
their=20
computer.&nbsp; They know the web site to which they are referred is not =
their=20
computer.&nbsp; They still are fooled.</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT>&nbsp;</DIV>
<DIV><FONT face=3DArial size=3D2>&nbsp;&nbsp; People know they are =
choosing&nbsp;to=20
download and install software from the Internet.&nbsp; What they may not = know
is=20
that it is or contains spyware.&nbsp; There is no confusion over=20
boundaries.</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT>&nbsp;</DIV>
<DIV><FONT face=3DArial size=3D2>&nbsp;&nbsp; I believe your whole idea =
of trust is=20
off base.&nbsp; People aren't making decisions on whether or not to = trust=20
particular machines.&nbsp; I douby very much most people even think that =

way.&nbsp; People place trust in other people or in some cases who they =
believe=20
those people are.&nbsp; Phishing attacks for bank sites succeed because =
the=20
people the fall pray to them believe that the people sending the email = are
valid=20
representitives of the bank and they trust those people.</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT>&nbsp;</DIV>
<DIV><FONT face=3DArial size=3D2>&nbsp;&nbsp; As for your initial =
premise, I=20
honestly don't know what it is you believe is consistent that should not = be
or=20
is different that should not be.&nbsp; You can't be referring to the =
browser=20
which is almost never used for the local computer and clearly identifies = what
is=20
local and what is not.</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT>&nbsp;</DIV>
<DIV><FONT face=3DArial size=3D2>&nbsp;&nbsp; Your claim regarding =
phishing is also=20
wrong.&nbsp; The address bar is one possible indicator to users.&nbsp; =
Phishing=20
attacks preceeded any of these and continue without them.&nbsp; I've = seen=20
phishing emails that make no attempt to mask the domain to which they=20
refer.&nbsp; People still get fooled.&nbsp; The address bar probably = means=20
little to many users.&nbsp; I can tell when speaking with and helping=20
non-technical users that even though they get that they type into the =
address=20
bar to go to a site they do not always get that it is overloaded to =
provide=20
feedback to them where they have gone.&nbsp; The same with the status =
bar.&nbsp;=20
Their have been status bar spoofs.&nbsp; They make little = difference.&nbsp;
Do=20
any of these make a difference to you so that you would be =
fooled?</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT>&nbsp;</DIV>
<DIV><FONT face=3DArial size=3D2>Rich</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT>&nbsp;</DIV>
<BLOCKQUOTE dir=3Dltr=20
style=3D"PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; =
BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
  <DIV>"Geo" &lt;<A =
href=3D"mailto:georger@nls.net">georger@nls.net</A>&gt; wrote=20
  in message <A=20
  =
href=3D"news:41ea4440@w3.nls.net">news:41ea4440@w3.nls.net</A>...</DIV>
  <DIV><FONT face=3DArial size=3D2>part of the reason it's so easy to =
fool people is=20
  because of Microsoft. Remember some years ago when I said to make a =
consistant=20
  interface that blurs the line between the local machine and remote=20
  machines/internet machines was a mistake? Well that's one of the big =
reasons=20
  why people today are so easy to fool. They don't understand the =
concept of=20
  trusted/untrusted machines because it all looks the same to them. They =

  honestly don't know where their machine ends and the rest of the world =

  begins.</FONT></DIV>
  <DIV><FONT face=3DArial size=3D2></FONT>&nbsp;</DIV>
  <DIV><FONT face=3DArial size=3D2>I understood the logic behind making =
that a=20
  consistent interface and blurring the line but I saw the problem with =
it as=20
  well. How is a user to know the difference between a remote website =
and a help=20
  page from one of their own programs if there is no =
difference?</FONT></DIV>
  <DIV><FONT face=3DArial size=3D2></FONT>&nbsp;</DIV>
  <DIV><FONT face=3DArial size=3D2>As for not knowing anyone who was =
infected due to=20
  the exploit of a bug, doesn't phishing work because of a bug that =
allows IE to=20
  show one address in the address bar while in fact it's talking to =
another=20
  address? What, doesn't that count?</FONT></DIV>
  <DIV><FONT face=3DArial size=3D2></FONT>&nbsp;</DIV>
  <DIV><FONT face=3DArial size=3D2>Geo.</FONT></DIV>
  <BLOCKQUOTE dir=3Dltr=20
  style=3D"PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; =
BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
    <DIV>"Rich" &lt;@&gt; wrote in message <A=20
    =
href=3D"news:41e9f4ea$1@w3.nls.net">news:41e9f4ea$1@w3.nls.net</A>...</DI=
V>
    <DIV><FONT face=3DArial size=3D2>&nbsp;&nbsp; You can't protect them =
from their=20
    own stupidity.&nbsp; I've seen plenty of examples of people getting =
infected=20
    with spyware due to their own explicit actions, either approving =
when asked=20
    if something should be installed or explicitly downloading and =
installing=20
    something that is or includes spyware.&nbsp; I do not know of anyone =

    personally that was infected due to an exploit of a bug.&nbsp; =
Phishing is=20
    another example that relies almost entirely on people being to =
trusting and=20
    doing something they shouldn't.&nbsp; I haven't seen an email virus=20
    in&nbsp;a long time that did not rely on the user following =
instructions in=20
    the email to act against his own interest and run or even save then =
open and=20
    run something they shouldn't.&nbsp; We are well beyond what many =
folks would=20
    consider security.&nbsp; To protect against people making these =
kinds of=20
    mistakes you have to take choices they can't be trusted making away =
from=20
    them.&nbsp; That upsets the folks that can be trusted to or want to =
make=20
    these choices unhappy.&nbsp; This isn't far from the idea that =
putting you=20
    in a straightjacket makes you more secure because you are less =
likely to=20
    hurt yourself.&nbsp; As for how people react to this, do you =
remember the=20
    reaction to cars that buzzed or otherwise made noise when the driver =
or a=20
    passenger did not wear his seat belt?&nbsp; It wasn't =
positive.</FONT></DIV>
    <DIV><FONT face=3DArial size=3D2></FONT>&nbsp;</DIV>
    <DIV><FONT face=3DArial size=3D2>Rich</FONT></DIV>
    <BLOCKQUOTE=20
    style=3D"PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; =
BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
      <DIV>"Ellen K." &lt;<A=20
      =
href=3D"mailto:72322.enno.esspeayem.1016@compuserve.com">72322.enno.esspe=
ayem.1016@compuserve.com</A>&gt;=20
      wrote in message <A=20
      =
href=3D"news:48qju0547j4l00akdf69j0bip7fgj8bmp5@4ax.com">news:48qju0547j4=
l00akdf69j0bip7fgj8bmp5@4ax.com</A>...</DIV>And=20
      that is a very big problem when trying to figure out what=20
      security<BR>features should be built in or what functionality =
should be=20
      allowed.&nbsp; Do<BR>we protect users from their own=20
      stupidity?&nbsp;&nbsp; I guess there is a<BR>rationale for doing =
so in=20
      that if the masses' machines are laxly secured<BR>(if at all), the =
danger=20
      to _everyone_ increases.<BR><BR>On Mon, 10 Jan 2005 15:07:12 =
-0800, "Rich"=20
      &lt;@&gt; wrote in message<BR>&lt;<A=20
      =
href=3D"mailto:41e30a96@w3.nls.net">41e30a96@w3.nls.net</A>&gt;:<BR><BR>&=
gt;&nbsp;&nbsp;=20
      I agree there are a great many people that have no interest in or=20
      familiarity with exercising the control available to them.&nbsp; =
That will=20
      always be true.&nbsp; <BR>&gt;<BR>&gt;Rich<BR>&gt;<BR>&gt;&nbsp; =
"Ellen=20
      K." &lt;<A=20
      =
href=3D"mailto:72322.enno.esspeayem.1016@compuserve.com">72322.enno.esspe=
ayem.1016@compuserve.com</A>&gt;=20
      wrote in message <A=20
      =
href=3D"news:7og4u0pj8f0nq10sm8t2covkac7q75oj1s@4ax.com">news:7og4u0pj8f0=
nq10sm8t2covkac7q75oj1s@4ax.com</A>...<BR>&gt;&nbsp;=20
      Well, I think this conversation is all over the place regarding =
who=20
      we<BR>&gt;&nbsp; are talking about when we talk about users.&nbsp; =
The=20
      folks here are an<BR>&gt;&nbsp; entirely different animal from the =
famous=20
      great unwashed masses.<BR>&gt;<BR>&gt;&nbsp; On Sun, 9 Jan 2005 =
01:40:28=20
      -0800, "Rich" &lt;@&gt; wrote in message<BR>&gt;&nbsp; &lt;<A=20
      =
href=3D"mailto:41e0fbe8@w3.nls.net">41e0fbe8@w3.nls.net</A>&gt;:<BR>&gt;<=
BR>&gt;&nbsp;=20
      &gt;&nbsp;&nbsp; Because you are in control, my point to=20
      george.<BR>&gt;&nbsp; &gt;<BR>&gt;&nbsp;=20
&gt;Rich<BR></BLOCKQUOTE></BLOCKQUOTE></BLOCKQUOTE></BODY></HTML>

------=_NextPart_000_06ED_01C4FBDE.025E1C10--

--- BBBS/NT v4.01 Flag-5
 * Origin: Barktopia BBS Site http://HarborWebs.com:8081 (1:379/45)