SoylentNews is people
SoylentNews
Arthur T Knackerbracket has found the following story from Bruce Schneier's blog:
Every few years, a researcher replicates a security study by littering USB sticks around an organization's grounds and waiting to see how many people pick them up and plug them in, causing the autorun function to install innocuous malware on their computers. These studies are great for making security professionals feel superior. The researchers get to demonstrate their security expertise and use the results as "teachable moments" for others. "If only everyone was more security aware and had more security training," they say, "the Internet would be a much safer place."
Enough of that. The problem isn't the users: it's that we've designed our computer systems' security so badly that we demand the user do all of these counterintuitive things. Why can't users choose easy-to-remember passwords? Why can't they click on links in emails with wild abandon? Why can't they plug a USB stick into a computer without facing a myriad of viruses? Why are we trying to fix the user instead of solving the underlying security problem?
Traditionally, we've thought about security and usability as a trade-off: a more secure system is less functional and more annoying, and a more capable, flexible, and powerful system is less secure. This "either/or" thinking results in systems that are neither usable nor secure.
[...] We must stop trying to fix the user to achieve security. We'll never get there, and research toward those goals just obscures the real problems. Usable security does not mean "getting people to do what we want." It means creating security that works, given (or despite) what people do. It means security solutions that deliver on users' security goals without -- as the 19th-century Dutch cryptographer Auguste Kerckhoffs aptly put it -- "stress of mind, or knowledge of a long series of rules."
[...] "Blame the victim" thinking is older than the Internet, of course. But that doesn't make it right. We owe it to our users to make the Information Age a safe place for everyone -- not just those with "security awareness."
(Score: 1) by Francis on Monday October 03 2016, @08:17PM
Pretty much, if you insert a USB disk into a computer, you shouldn't have things executing from it unless you set them up to execute. And documents should never have executables embedded.
(Score: 2) by DannyB on Monday October 03 2016, @08:49PM
I agree with that.
But I disagree with the article's point about not changing the user.
The world is not a safe place. And nothing will magically make it so.
A good lock on your home's front door is better than a poor lock. Just as an OS that doesn't autoexec executables, is better than an OS that does. And better yet, the OS that doesn't autoexec executables should not even recognize it as an executable unless it has the right file permission, and USB media should be set up in your /etc/fstab so that execution cannot happen from that media. But you don't find an /etc/fstab in the OS that traces its history back to a copy of CP/M.
To transfer files: right-click on file, pick Copy. Unplug mouse, plug mouse into other computer. Right-click, paste.
(Score: 3, Interesting) by VLM on Monday October 03 2016, @09:46PM
The world is not a safe place.
True but my point in the grandparent post is some end user behavior should as a cultural thing be seen as icky. Like eating food out of a dumpster or sharing underwear with random strangers. Or IV needles for that matter. Note thats all actually pretty safe statistically speaking, but still seen as super gross. As it should be.
It appears not to be possible to discuss the cultural aspect of it. We're only allowed to agree that our immune systems should be strong enough to tolerate it, the original author thinks filthy users should not have to behave in a civilized manner and I'm asking them to keep it classy, or at least try.
I think we would all be happy in a world where computer security doesn't suck.
The original article author wants users to continue to behave like dirt bags. Personally I would prefer something a little more civilized and don't mind calling the users on their gross behavior.
(Score: 1) by Francis on Tuesday October 04 2016, @12:53AM
Right. Certain practices are too dangerous to enable, but you can never completely secure against the end user. And if you lock things down too much people hack around it.
(Score: 2) by mcgrew on Tuesday October 04 2016, @12:01AM
A good lock on your home's front door is better than a poor lock.
It doesn't matter, they have crowbars. Your locks will be safe, but not your door or belongings; that's how burglars broke into my house. Besides, what house has no windows?
mcgrewbooks.com mcgrew.info nooze.org
(Score: 1) by Francis on Tuesday October 04 2016, @01:49PM
The point of locks and sturdy doors isn't to prevent people from the possibility of breaking in. The point of it is to raise the signature of people trying to break in. If they're having to mess around with the lock for a few minutes, that's going to deter a lot of burglars that would like to be in and out in a matter of a couple minutes. Especially if you're in an area that people frequent unpredictably.
If you can make your stuff slightly harder to break into than the other people's stuff, then you'll find a lot of criminals just skip it for the next house.
(Score: 3, Insightful) by JNCF on Monday October 03 2016, @10:25PM
Pretty much, if you insert a USB disk into a computer, you shouldn't have things executing from it unless you set them up to execute.
I don't want that to happen either, but most users do. Most users want to be able to use USB sticks in the same ports that they can plug keyboards into. Most users don't want to have to manually enable a keyboard after plugging it in. Therefore, most users implicitly want a computer that will allow malicious USB drives to type any arbitrary command into their computers (even though they don't explicitly realise this). If the problem were made clear to them, I think most users would begrudgingly choose convenience over security and then quickly proceed to forget about the problem entirely. The traditional trade-off Schneier eschews is very real, and users simply can't have both security and convenience in the levels they desire. Hopefully our priorities will change as people get more educated.
(Score: 1) by Francis on Tuesday October 04 2016, @12:50AM
A lot of this has to do with expected use and visibility. Usb disks are usually used to transfer files between computers, so it makes no sense to enable execution from there.
Likewise email attachments should have to be downloaded manually before manual execution. And documents shouldn't ever be executable.
The point is that reasonable actions should be planned for and secured. Complete security is never possible and users do need to do their share, but the system shouldn't be enabling incompetence or hiding risks.
(Score: 3, Informative) by JNCF on Tuesday October 04 2016, @01:53AM
I was trying to point out that even with execution from USB drives disabled your computer can still be susceptible to malicious drives that simply pretend to be keyboards and type commands in. There is a decision to be made here: we cannot simultaneously have universal ports, permissionless keyboards that don't rely on brittle third-party certificate schemes, and a feeling of safety when plugging in a USB drive found in a parking lot. Obviously, we should grant USB keyboards permissions individually. I suspect most users would hate that, but I'd love to be wrong.
(Score: 1) by Francis on Tuesday October 04 2016, @01:46PM
That's true, but that's something else that the computers should be guarding against. Same goes for those cracks that involve firmware of things like monitors that nobody can reasonably be expected to worry about.
But, at some point, there is a limit to what can reasonably be done about things of this nature. I suspect in terms of malicious devices, a pop up confirming that you plugged in a certain type of device and usb drives not being allowed to type or keyboards not being allowed to have internal memory would make things considerably harder. Probably just a one time deal with some sort of hash to verify that it's the same device that was previously whitelisted.
(Score: 2) by maxwell demon on Tuesday October 04 2016, @07:21AM
They want it because they've been educated to want it. It's also much more convenient to enter a house without first needing to unlock it. Yet I'm not aware of people demanding no-lock front doors.
I'm not aware of anyone in the pre-USB times complaining that you plugged the keyboard to another port than the printer. There were some complaints about PS/2 keyboard and mouse, but that was because they were too similar without being identical; I'm not aware of similar complaints with the earlier serial mice.
Also I'm sure that the vast majority of people don't ever change the keyboard that came with their computer. So there could be keyboard pairing, and the computer could come with the keyboard already paired, just as the OS is already installed.
Also note that people accept entering long sequences of meaningless characters at installation for "product activation" where the only one having an advantage is the provider of the software. You won't tell me that it is not inconvenient. So why should people not accept some inconvenience for hardware installation when they get more security in return? Again, they do accept door locks for security, too.
Of course that doesn't mean the software designers don't also have an obligation to make reasonable security reasonably easy. But that does not mean to sacrifice security for ease of use.
The Tao of math: The numbers you can count are not the real numbers.
(Score: 2) by tangomargarine on Tuesday October 04 2016, @02:17PM
Also I'm sure that the vast majority of people don't ever change the keyboard that came with their computer. So there could be keyboard pairing, and the computer could come with the keyboard already paired, just as the OS is already installed.
A decent idea technically, but I'm sure it would be abused by the companies selling the computers before you can say, "Hey, does anybody remember SecureBoot? That guy standing over you with a hammer assuring you he won't use it?"
"Is that really true?" "I just spent the last hour telling you to think for yourself! Didn't you hear anything I said?"
(Score: 2) by JNCF on Tuesday October 04 2016, @05:51PM
They want it because they've been educated to want it. It's also much more convenient to enter a house without first needing to unlock it. Yet I'm not aware of people demanding no-lock front doors.
We've been using physical locks of some sort for thousands of years, and some folks still fail to keep their doors locked (it seems fairly common on the East coast of the US, anecdotally). I hope that within a generation or two we take information security at least as seriously as we currently take physical security, but I'm very skeptical of our ability to inculturate those concerns into people who haven't been exposed to them at a young age and aren't seeking out better security practices of their own volition. Again, I'd love to be wrong about this. Schneier is basically arguing that we shouldn't even try because that would be blaming the victim, you insensitive clod, you! I really like some of his writing, but I found this particular piece uncompelling.
Also note that people accept entering long sequences of meaningless characters at installation for "product activation" where the only one having an advantage is the provider of the software.
It doesn't matter how much users would prefer a product that doesn't require an activation step if they don't pay for the product. Customer satisfaction is only one factor in the profit motive equation. I agree that people would still use computers if they had more mildly annoying security practices like keyboard permissions by default, I just think that they would prefer computers without that bug/feature. If Windows implemented it and OSX didn't, I think that would generally be seen as a point in favor of OSX. I hope I'm wrong.