Hacker News Reader

Comment by MisterSandman | Hacker News Reader

> I just know I'll have a Thanksgiving conversation like "hey, could you look at my phone? It's been getting hot after Microsoft called and helped me install the new antivirus."

Why do we pretend that social engineering scams don't exist outside of installing anti-viruses? There are thousands of vectors of attack, many of which can and have been done on iPhones (bank accounts, gift card scams etc.)

The solution to this problem is EDUCATION, not letting companies monopolize a market just because we're too scared and stupid as a society to teach the elderly and vulnerable about security and privacy.

View on HN

> Why do we pretend that social engineering scams don't exist outside of installing anti-viruses?

Nobody is pretending that.

> The solution to this problem is EDUCATION…

Nope. Educated, tech-savvy people fall prey to scams all the time: https://www.cnbc.com/2021/08/10/tech-savvy-teens-falling-pre...

I wouldn't call teens tech-savvy if all they do is click on apps all day, and I doubt any of them have been educated about computer security or vectors of attack at all. Ask them how to update their firewall to prevent attacks on newly installed App X, and you'll get blank stares. Hell, many young people have no idea what files and folders are[1].

I was reviewing a computer class curriculum for a younger cousin who is in high school. All they're doing is learning how to format documents and use spreadsheets. Being able to use an office app suite does not equal being tech-savvy or being educated about computer security.

[1] https://www.theverge.com/22684730/students-file-folder-direc...

Even if that article wasn't the best there are tons of articles in the category. Here is one:

https://www.techtarget.com/searchsecurity/news/252495750/How...

> …I doubt any of them have been educated about computer security or vectors of attack at all.

My kids (who go to a public school) have received what I consider thorough instruction on avoiding online scams and other kinds of danger. It sounds like YMMV, unfortunately.

But the main takeaway is that education doesn't make people scam-proof. The link at https://www.bbbmarketplacetrust.org/story/39089233/research isn't working as I type this, but Cracking the Invulnerability Illusion: Stereotypes, Optimism Bias, and the Way Forward for Marketplace Scam Education is a really interesting research paper on this. (I've pinged the author and will post a working link when she responds.)

That article doesn't say much about education right? Just age

> Why do we pretend that social engineering scams don't exist outside of installing anti-viruses?

That's was an example, but only an except. I think equally plausible is "my bank called and told me my app was broken and that I needed to redownload it. I tried logging into the new app with my bank username and password, but it didn't work. What's wrong with my phone?" Now, Apple doesn't have a perfect track record for catching and blocking these things. Their security controls are definitely better than not having them, though.

> The solution to this problem is EDUCATION

No, no, no. One of the things drilled into your head at security engineering and management conferences is not to ever trust the human factor. Education is a good thing to have in addition to all your other controls, but is a terrible first line of defense. People make terrible choices all the time. Maybe they're sick, or they've had a drink or three, or they're worried about something that happened at work, etc. etc. etc. Even smart people who've completed security training still make dumb mistakes.

> "my bank called and told me my app was broken and that I needed to redownload it..."

This problem isn't solved by the centralized App Store--even if it were good at blocking any app with functionality that would let it be used as a scam (which it is not)--as it is just as if not even easier to tell the person "your app is broken and you will need to use our website" and then give them the wrong URL.

Like, I don't understand what you are trying to accomplish here: you think your elderly parents are going to go through a number of steps to install software via a different process but won't go to a website? I bet going to a website would even be a prerequisite to sideloading, so why would the attacker bother adding even more steps?

You are thereby helping Apple do something bad for both society and large numbers of other people and you didn't even manage to get the one thing you wanted out of it :(.

If EDUCATION was a solution to things then people wouldn't be patching trivial buffer overflows every other week... (I'm pretty sure the first thing they teach you in C about arrays and malloc is you don't access memory outside the specified bounds.)

People think the world is flat and that Covid is a political hoax so no, education won’t get very far in some parts of the world.

How has that worked for the past 30 years?

Reply on news.ycombinator.com