Web Insecurity: Apathy or sensible risk evaluation: why don't people care about security?

[terriko]

Starbucks' Christmas Bokeh
by pierofix.

Engineer Gary LosHuertos decided to try Herding Firesheep in New York City: He sat down in a Starbucks, opened up his laptop and started gathering profiles, then sent messages to people whose facebook accounts he could access warning them of the security flaws. Some people closed up and left, but some just ignored his message and went on with their day. Confused, he sent another message, but they just didn't seem to care and continued using their accounts.

He was appalled that people, even when warned, would ignore a security flaw, but it's actually well known that people reject advice. The interesting part of the story comes with Cormac Herley's paper "So Long, And No Thanks for the Externalities: The Rational Rejection of Security Advice by Users" -- it turns out that it makes perfect sense that people refuse to do security things, and fixing the flaws that firesheep draws attention to is just another example of where security advice just isn't worth following.

You can read the full version of this post on Web Insecurity: Apathy or sensible risk evaluation: why don't people care about security?

Comments

Ignoring security-advice

[(Anonymous)]

Offcourse users ignore security-advice. What is the alternative ? Follow it ? Don't be ridicolous !

* Check every program installed on your windows-computer for updates regularily, for example weekly. This is a many-hour job if you're an average user with ~50 programs installed, 40 of which don't automatically tell you about updates.

* Pick 8+ character semi-random UNRELATED passwords for each of the 173 websites you're registered on, DONT write them down, CHANGE them regularily. Come on, that advice basically boils down to: "don't be human"

A security-policy that depends on humans not being human, is broken. And it's unreasonable to blame the users for the policy being broken

Re: Ignoring security-advice

[terriko]

I have this theory that organizations requiring passwords are like teachers setting assignments. You know how you always end up with 4 assignments due on the same day, and half of them would take 20hrs/week to complete, which adds up to way more time than you have? Yeah. Just like that one class isn't more important to me than all others, that one site is generally not so important that i'm suddenly going to go out of my way to be super secure there. Sure, some sites are important enough just like some classes are important enough to justify 20hrs/week, but on the whole, you've got to assume you're that prerequisite that no one cares about.