11–20 of 106 posts
But when I'm trying to explain to my dad how to know what to trust and what not to trust I realise it's completely hopeless. You can fake almost everything that a non-techie would know to check.
He's right. Most of the time, the things that tip me off are the misspelled words and poor grammar; also, the conflicting information. For example, getting an email message from Chase Bank with a signature from a Wells Fargo employee. A lot of people are one well versed phisher from losing a lot of time and money.
It turns out the letter really did come from BoA.
EDIT: and once Chase sent me a letter telling me to reply by September 31. http://danweber.blogspot.com/2009/08/chase-does-it-again.htm...
The problem is that the people who click on these also have lousy grammar and don't notice, don't care, or won't actually read all of the text. There's only so much we can do if the end user refuses to think. I suspect a lot of these people will be migrating to locked down/walled garden devices soon anyway.
I was watching a user a month or so afterwards to notice they just pressed enter every time an alert box popped up, immediately, without reading and without thought.
Alerts on computers aren't there to be read any more. They're confusing annoyances that you just click yes to. They're usually badly written in that they tell a normal person nothing, they're without context and usually ultimately exist because a programmer was prevaricating on making a decision.
We nagged our users too much as programmers, to turn around and blame them for not thinking is a sublime irony given that we were the ones not thinking and constantly asking for reassurance that it was us not making a mistake.
In moments of distraction I've had a couple of near-misses where I nearly clicked on malware. But when I'm trying to explain to my dad how to know what to trust and what not to trust I realise it's completely hopeless. You can fake almost everything that a non-techie would know to check.
other than Dropbox public url's the services that exiist have so many images with the word "Download" in the resulting link, all of which look exactly like a UX element, that you have to click about half of them or play Sherlock Holmes to uncover the real download link. It's like a scratch-off lottery.
Note to malware coders: add ignore, repair, quarantine buttons that run the same code.
Selection is probably not the best way to check whether something is browser content...
-webkit-touch-callout: none;
-webkit-user-select: none;
-khtml-user-select: none;
-moz-user-select: none;
-ms-user-select: none;
user-select: none;If something asks you about update/downloading/etc., reject it. You decide what to do and when, and you type the URL into the browser, or go to the normal menu/dialog/tool for updating.
(This is partly why Chrome browser is right and the normal approach is wrong: if/when it needs update, it just does it.)
He's right. Most of the time, the things that tip me off are the misspelled words and poor grammar; also, the conflicting information. For example, getting an email message from Chase Bank with a signature from a Wells Fargo employee. A lot of people are one well versed phisher from losing a lot of time and money.
Once I got a letter from Bank Of America that they had noticed weird activity on my home equity line of credit, with a weird phone number to call to talk. No one answered that number, and I don't have an equity line. It turns out the letter really did come from BoA. EDIT: and once Chase sent me a letter telling me to reply by September 31. http://danweber.blogspot.com/2009/08/chase-does-it-again.htm...
The customer service people at the card had no clue what was going on. They'd never heard of it either. They told me they'd escalate the question to a manager and call my back, but they never did.
Scott's right, of course. But to the advantage of the good guys, anybody with the brains and discipline to do a better job of this kind of thing, is much more likely to be able to make a better living honestly, than through fraud and deception.