Hacker News Reader

“Most people aren't as dumb as your ego likes to imagine them to be. They may not know the details of how their computers work but they know sketchy looking crap when they see it.”

That’s simply not true. Like, at all. If it were, then viruses and malware wouldn’t be spreading like they are, especially phishing campaigns. I know many very smart people who have been compromised.

I also take issue with the word “dumb” — “smart” people can be caught off guard as well. Not everything looks sketchy, as good phishing does everything right to make you think it’s all ok.

It’s a really difficult type of software to create, and perhaps there’s room for new computer vision type anti-viruses to find look-a-like websites, but normal humans need all the help they can get!

> I also take issue with the word “dumb” — “smart” people can be caught off guard as well.

Yeah, exactly my point. People aren't as dumb as you think they are because you and I are just about as dumb, we just think we're better than them because we understand some things they don't.

And more to the point, the thing about successful malware and phishing campaigns is that AV already does a shit job of stopping them. If you are inclined to believe something is legit, you're going to tell your AV or filter to shut the hell up and just do it anyway. The AV adds practically nothing and does it at a real cost.

I agree with what you're saying, but it's worth noting that the kinds of attacks you're talking about cannot be reliably stopped by anti-virus.

Instead, they're stopped by almost constant security training. And, I'd argue that if your security training is good enough to get people to recognize phishing, spearphishing and the ilk, it's good enough to get them to recognize the kinds of low hanging fruit that reactive anti-virus software protects against.

I think "dumb" is the incorrect word for this context. They simply lack the awareness. Us IT folks hang around in places like HN where we constantly bombarded with advisories against viruses and online scams, and hence well-aware of them.

> Most people aren't as dumb as your ego likes to imagine them to be. They may not know the details of how their computers work but they know sketchy looking crap when they see it.

Dumb isn't the word I'd use. If there were a less demeaning way of saying unaware, or ignorant, of black hat / scam trends, that's the wording I'd use.

Most people, including myself, are pretty bad a calculating risk when doing innocuous things like checking e-mail, logging in to websites or visiting a site with stealthy malicious content.

>At worst they are constantly getting in your way with false positives

Actually, at worst, they can increase your attack surface and have, on more than one instance I can think of, introduced exploitable vulnerabilities that would not have existed without the antivirus.

At worst, AV is an increase in attack surface, as detailed in the CIA wikileaks.

Not everyone's threat model includes actors out there bypassing AV. Most people need AV to be able to protect themselves against accidentally opening a spammy, script-kiddie level spam mail.

Most viruses out there are bypassing AV.

There was precisely nothing regarding exploiting AV vulns in the CIA leaks.

The leaks did contain some really basic obfuscation techniques to defeat AVs, but that's nothing new.

Sorry, I must have mixed it up with a different press release. Anyway, this is the first thing I found when trying to find it again.

https://www.wired.com/2017/03/clever-doubleagent-attack-turn...

Eh, your "not as dumb as you think" is unnecessarily hostile. Also, nobody except you was calling people dumb, it's some weird rhetoric.

But I will say that I regularly help people including my parents who are tricked by those fake download-button ads. I'm not calling them dumb -- you were in your own premise. But that's one avenue for people to install malware on their computer.

"Don't worry about it, people don't get tricked!" is just false.

>Also, nobody except you was calling people dumb

In this thread, no. But that’s a very common prevailing theme, that normal users are “dumb” compared to techies. Ask any help desk technician or desktop support employee or the BOFH or really anyone who deals with end users. Chances are they’re gonna say end users are dumb.

If anything, this persons attitude is refreshing, giving end users a bit more credit.

"Most people aren't as dumb as your ego likes to imagine them to be."

My ego doesn't have to imagine anything. People inadvertently install malware all the time. I've personally done the deed of cleaning all that garbage up on hundreds of occasions.

This doesn't necessarily mean installing AV, though; a sufficiently-motivated idiot (or someone smart enough to be dangerous) will figure out a way to disable it anyway using a random website from a Google search as a reference. It does mean either locking down access or giving the user proper education (namely: "don't install random crap from the Internet, even if the Internet tells you to do so").

This attitude is so completely negligent I dont even know where to start. Its dangerously misinformed. ('i never caught a virus, why bother'). AV catches the low hanging fruit. If you do not have it, you will forever be poisoned by that low hanging fruit.