Text 2064, 444 rader
Skriven 2005-01-18 17:45:56 av Rich (1:379/45)
Kommentar till text 2057 av Geo (1:379/45)
Ärende: Re: Do we protect users from their own stupidity?
=========================================================
From: "Rich" <@>
This is a multi-part message in MIME format.
------=_NextPart_000_001B_01C4FD85.90215DC0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Full headers, yes. In the options dialog.
Rich
"Geo" <georger@nls.net> wrote in message news:41eda613@w3.nls.net...
In the current version of Outlook, is there a way to view the source =
for an email without opening the email first like you can do in Outlook =
express?=20
Geo.
"Rich" <@> wrote in message news:41ec70a9@w3.nls.net...
Or care to do any of those three? It is easy enough to do them =
all in any of the Microsoft email clients I use. People don't becuase = they
don't care to. Those that care do.
Rich
"Ellen K." <72322.enno.esspeayem.1016@compuserve.com> wrote in =
message news:ltcou0lhvanrbp6su81dokr26fcrpiftfa@4ax.com...
Periodically I get phishing emails pretending to be from ebay, and =
they
even manage to get "ebay" into the headers, but if you look up the =
IP
address of course you find out it's not... but what percentage of =
users
A) know how to find the header;
B) know how to read it; or
C) know how to look up an IP address?
On Sun, 16 Jan 2005 15:14:01 -0800, "Rich" <@> wrote in message
<41eaf508@w3.nls.net>:
> I disagree.
>
> People do very much know the difference between their own =
computer and the other computers referenced in phishing attacks. They = know
that email comes from somewhere outside their computer. They know = the web
site to which they are referred is not their computer. They = still are
fooled.
>
> People know they are choosing to download and install software =
from the Internet. What they may not know is that it is or contains = spyware.
There is no confusion over boundaries.
>
> I believe your whole idea of trust is off base. People aren't =
making decisions on whether or not to trust particular machines. I = douby
very much most people even think that way. People place trust in = other
people or in some cases who they believe those people are. = Phishing attacks
for bank sites succeed because the people the fall pray = to them believe that
the people sending the email are valid = representitives of the bank and they
trust those people.
>
> As for your initial premise, I honestly don't know what it is =
you believe is consistent that should not be or is different that should = not
be. You can't be referring to the browser which is almost never = used for the
local computer and clearly identifies what is local and = what is not.
>
> Your claim regarding phishing is also wrong. The address bar =
is one possible indicator to users. Phishing attacks preceeded any of = these
and continue without them. I've seen phishing emails that make no = attempt to
mask the domain to which they refer. People still get = fooled. The address
bar probably means little to many users. I can = tell when speaking with and
helping non-technical users that even though = they get that they type into the
address bar to go to a site they do not = always get that it is overloaded to
provide feedback to them where they = have gone. The same with the status bar.
Their have been status bar = spoofs. They make little difference. Do any of
these make a difference = to you so that you would be fooled?
>
>Rich
>
> "Geo" <georger@nls.net> wrote in message =
news:41ea4440@w3.nls.net...
> part of the reason it's so easy to fool people is because of =
Microsoft. Remember some years ago when I said to make a consistant = interface
that blurs the line between the local machine and remote = machines/internet
machines was a mistake? Well that's one of the big = reasons why people today
are so easy to fool. They don't understand the = concept of trusted/untrusted
machines because it all looks the same to = them. They honestly don't know
where their machine ends and the rest of = the world begins.
>
> I understood the logic behind making that a consistent =
interface and blurring the line but I saw the problem with it as well. = How is
a user to know the difference between a remote website and a help = page from
one of their own programs if there is no difference?
>
> As for not knowing anyone who was infected due to the exploit =
of a bug, doesn't phishing work because of a bug that allows IE to show = one
address in the address bar while in fact it's talking to another = address?
What, doesn't that count?
>
> Geo.
> "Rich" <@> wrote in message news:41e9f4ea$1@w3.nls.net...
> You can't protect them from their own stupidity. I've =
seen plenty of examples of people getting infected with spyware due to = their
own explicit actions, either approving when asked if something = should be
installed or explicitly downloading and installing something = that is or
includes spyware. I do not know of anyone personally that = was infected due
to an exploit of a bug. Phishing is another example = that relies almost
entirely on people being to trusting and doing = something they shouldn't. I
haven't seen an email virus in a long time = that did not rely on the user
following instructions in the email to act = against his own interest and run
or even save then open and run = something they shouldn't. We are well beyond
what many folks would = consider security. To protect against people making
these kinds of = mistakes you have to take choices they can't be trusted making
away from = them. That upsets the folks that can be trusted to or want to make
= these choices unhappy. This
>isn't far from the idea that putting you in a straightjacket =
makes you more secure because you are less likely to hurt yourself. As = for
how people react to this, do you remember the reaction to cars that = buzzed or
otherwise made noise when the driver or a passenger did not = wear his seat
belt? It wasn't positive.
>
> Rich
> "Ellen K." <72322.enno.esspeayem.1016@compuserve.com> wrote =
in message news:48qju0547j4l00akdf69j0bip7fgj8bmp5@4ax.com...
> And that is a very big problem when trying to figure out =
what security
> features should be built in or what functionality should be =
allowed. Do
> we protect users from their own stupidity? I guess there =
is a
> rationale for doing so in that if the masses' machines are =
laxly secured
> (if at all), the danger to _everyone_ increases.
>
> On Mon, 10 Jan 2005 15:07:12 -0800, "Rich" <@> wrote in =
message
> <41e30a96@w3.nls.net>:
>
> > I agree there are a great many people that have no =
interest in or familiarity with exercising the control available to = them.
That will always be true. =20
> >
> >Rich
> >
> > "Ellen K." <72322.enno.esspeayem.1016@compuserve.com> =
wrote in message news:7og4u0pj8f0nq10sm8t2covkac7q75oj1s@4ax.com...
> > Well, I think this conversation is all over the place =
regarding who we
> > are talking about when we talk about users. The folks =
here are an
> > entirely different animal from the famous great unwashed =
masses.
> >
> > On Sun, 9 Jan 2005 01:40:28 -0800, "Rich" <@> wrote in =
message
> > <41e0fbe8@w3.nls.net>:
> >
> > > Because you are in control, my point to george.
> > >
> > >Rich
------=_NextPart_000_001B_01C4FD85.90215DC0
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=3DContent-Type content=3D"text/html; =
charset=3Diso-8859-1">
<META content=3D"MSHTML 6.00.3790.1289" name=3DGENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=3D#ffffff>
<DIV><FONT face=3DArial size=3D2> Full headers, yes. =
In the=20
options dialog.</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2>Rich</FONT></DIV>
<DIV> </DIV>
<BLOCKQUOTE dir=3Dltr=20
style=3D"PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; =
BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV>"Geo" <<A =
href=3D"mailto:georger@nls.net">georger@nls.net</A>> wrote=20
in message <A=20
=
href=3D"news:41eda613@w3.nls.net">news:41eda613@w3.nls.net</A>...</DIV>
<DIV><FONT face=3DArial size=3D2>In the current version of Outlook, is =
there a way=20
to view the source for an email without opening the email first like =
you can=20
do in Outlook express? </FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2>Geo.</FONT></DIV>
<BLOCKQUOTE dir=3Dltr=20
style=3D"PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; =
BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV>"Rich" <@> wrote in message <A=20
=
href=3D"news:41ec70a9@w3.nls.net">news:41ec70a9@w3.nls.net</A>...</DIV>
<DIV><FONT face=3DArial size=3D2> Or care to do any of =
those=20
three? It is easy enough to do them all in any of the =
Microsoft email=20
clients I use. People don't becuase they don't care to. =
Those=20
that care do.</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2>Rich</FONT></DIV>
<DIV> </DIV>
<BLOCKQUOTE=20
style=3D"PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; =
BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV>"Ellen K." <<A=20
=
href=3D"mailto:72322.enno.esspeayem.1016@compuserve.com">72322.enno.esspe=
ayem.1016@compuserve.com</A>>=20
wrote in message <A=20
=
href=3D"news:ltcou0lhvanrbp6su81dokr26fcrpiftfa@4ax.com">news:ltcou0lhvan=
rbp6su81dokr26fcrpiftfa@4ax.com</A>...</DIV>Periodically=20
I get phishing emails pretending to be from ebay, and they<BR>even =
manage=20
to get "ebay" into the headers, but if you look up the =
IP<BR>address of=20
course you find out it's not... but what percentage of users<BR>A) =
know=20
how to find the header;<BR>B) know how to read it; or<BR>C) know =
how to=20
look up an IP address?<BR><BR>On Sun, 16 Jan 2005 15:14:01 -0800, =
"Rich"=20
<@> wrote in message<BR><<A=20
=
href=3D"mailto:41eaf508@w3.nls.net">41eaf508@w3.nls.net</A>>:<BR><BR>&=
gt; =20
I disagree.<BR>><BR>> People do very much know =
the=20
difference between their own computer and the other computers =
referenced=20
in phishing attacks. They know that email comes from =
somewhere=20
outside their computer. They know the web site to which they =
are=20
referred is not their computer. They still are=20
fooled.<BR>><BR>> People know they are choosing =
to=20
download and install software from the Internet. What they =
may not=20
know is that it is or contains spyware. There is no =
confusion over=20
boundaries.<BR>><BR>> I believe your whole idea =
of trust=20
is off base. People aren't making decisions on whether or =
not to=20
trust particular machines. I douby very much most people =
even think=20
that way. People place trust in other people or in some =
cases who=20
they believe those people are. Phishing attacks for bank =
sites=20
succeed because the people the fall pray to them believe that the =
people=20
sending the email are valid representitives of the bank and they =
trust=20
those people.<BR>><BR>> As for your initial =
premise, I=20
honestly don't know what it is you believe is consistent that =
should not=20
be or is different that should not be. You can't be =
referring to the=20
browser which is almost never used for the local computer and =
clearly=20
identifies what is local and what is =
not.<BR>><BR>> Your=20
claim regarding phishing is also wrong. The address bar is =
one=20
possible indicator to users. Phishing attacks preceeded any =
of these=20
and continue without them. I've seen phishing emails that =
make no=20
attempt to mask the domain to which they refer. People still =
get=20
fooled. The address bar probably means little to many =
users. I=20
can tell when speaking with and helping non-technical users that =
even=20
though they get that they type into the address bar to go to a =
site they=20
do not always get that it is overloaded to provide feedback to =
them where=20
they have gone. The same with the status bar. Their =
have been=20
status bar spoofs. They make little difference. Do any =
of=20
these make a difference to you so that you would be=20
fooled?<BR>><BR>>Rich<BR>><BR>> "Geo" <<A=20
href=3D"mailto:georger@nls.net">georger@nls.net</A>> wrote in =
message <A=20
=
href=3D"news:41ea4440@w3.nls.net">news:41ea4440@w3.nls.net</A>...<BR>>=
=20
part of the reason it's so easy to fool people is because of =
Microsoft.=20
Remember some years ago when I said to make a consistant interface =
that=20
blurs the line between the local machine and remote =
machines/internet=20
machines was a mistake? Well that's one of the big reasons why =
people=20
today are so easy to fool. They don't understand the concept of=20
trusted/untrusted machines because it all looks the same to them. =
They=20
honestly don't know where their machine ends and the rest of the =
world=20
begins.<BR>><BR>> I understood the logic behind making =
that a=20
consistent interface and blurring the line but I saw the problem =
with it=20
as well. How is a user to know the difference between a remote =
website and=20
a help page from one of their own programs if there is no=20
difference?<BR>><BR>> As for not knowing anyone who =
was=20
infected due to the exploit of a bug, doesn't phishing work =
because of a=20
bug that allows IE to show one address in the address bar while in =
fact=20
it's talking to another address? What, doesn't that=20
count?<BR>><BR>> Geo.<BR>> "Rich" =
<@> wrote in message <A=20
=
href=3D"news:41e9f4ea$1@w3.nls.net">news:41e9f4ea$1@w3.nls.net</A>...<BR>=
> =20
You can't protect them from their own stupidity. I've seen =
plenty of=20
examples of people getting infected with spyware due to their own =
explicit=20
actions, either approving when asked if something should be =
installed or=20
explicitly downloading and installing something that is or =
includes=20
spyware. I do not know of anyone personally that was =
infected due to=20
an exploit of a bug. Phishing is another example that relies =
almost=20
entirely on people being to trusting and doing something they=20
shouldn't. I haven't seen an email virus in a long time that =
did not=20
rely on the user following instructions in the email to act =
against his=20
own interest and run or even save then open and run something they =
shouldn't. We are well beyond what many folks would consider =
security. To protect against people making these kinds of =
mistakes=20
you have to take choices they can't be trusted making away from=20
them. That upsets the folks that can be trusted to or want =
to make=20
these choices unhappy. This<BR>>isn't far from the idea =
that=20
putting you in a straightjacket makes you more secure because you =
are less=20
likely to hurt yourself. As for how people react to this, do =
you=20
remember the reaction to cars that buzzed or otherwise made noise =
when the=20
driver or a passenger did not wear his seat belt? It wasn't=20
positive.<BR>><BR>> =20
Rich<BR>> "Ellen K." <<A=20
=
href=3D"mailto:72322.enno.esspeayem.1016@compuserve.com">72322.enno.esspe=
ayem.1016@compuserve.com</A>>=20
wrote in message <A=20
=
href=3D"news:48qju0547j4l00akdf69j0bip7fgj8bmp5@4ax.com">news:48qju0547j4=
l00akdf69j0bip7fgj8bmp5@4ax.com</A>...<BR>> &nb=
sp;=20
And that is a very big problem when trying to figure out what=20
security<BR>> features should be =
built in=20
or what functionality should be allowed. =20
Do<BR>> we protect users from =
their own=20
stupidity? I guess there is=20
a<BR>> rationale for doing so in =
that if=20
the masses' machines are laxly=20
secured<BR>> (if at all), the =
danger to=20
_everyone_ =
increases.<BR>><BR>> On=20
Mon, 10 Jan 2005 15:07:12 -0800, "Rich" <@> wrote in=20
message<BR>> <<A=20
=
href=3D"mailto:41e30a96@w3.nls.net">41e30a96@w3.nls.net</A>>:<BR>><=
BR>> =20
> I agree there are a great many people that have =
no=20
interest in or familiarity with exercising the control available =
to=20
them. That will always be true. =20
<BR>> =20
><BR>> =20
>Rich<BR>> =20
><BR>> > "Ellen K." =
<<A=20
=
href=3D"mailto:72322.enno.esspeayem.1016@compuserve.com">72322.enno.esspe=
ayem.1016@compuserve.com</A>>=20
wrote in message <A=20
=
href=3D"news:7og4u0pj8f0nq10sm8t2covkac7q75oj1s@4ax.com">news:7og4u0pj8f0=
nq10sm8t2covkac7q75oj1s@4ax.com</A>...<BR>> &nb=
sp;=20
> Well, I think this conversation is all over the place =
regarding=20
who we<BR>> > are =
talking about=20
when we talk about users. The folks here are=20
an<BR>> > entirely =
different=20
animal from the famous great unwashed=20
masses.<BR>> =20
><BR>> > On Sun, 9 =
Jan 2005=20
01:40:28 -0800, "Rich" <@> wrote in=20
message<BR>> > <<A=20
=
href=3D"mailto:41e0fbe8@w3.nls.net">41e0fbe8@w3.nls.net</A>>:<BR>>&=
nbsp; =20
><BR>> > =
> =20
Because you are in control, my point to=20
george.<BR>> > =20
><BR>> > =20
>Rich<BR></BLOCKQUOTE></BLOCKQUOTE></BLOCKQUOTE></BODY></HTML>
------=_NextPart_000_001B_01C4FD85.90215DC0--
--- BBBS/NT v4.01 Flag-5
* Origin: Barktopia BBS Site http://HarborWebs.com:8081 (1:379/45)
|