Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Oxford Temporarily Blocks Google Docs

blogs.oucs.ox.ac.uk

Post reply on HN
Print view View original

121–130 of 160 posts

Re: Oxford Temporarily Blocks Google Docs

#121

Post by thomaslangston »

marbletiles wrote: post #110
subway wrote: post #84

Earlier quoted context omitted.

I'd like to use my car like a tool. Why do manufacturers make them so difficult to safely operate, I shouldn't require any additional training to operate it, I should be able to just hop in at location A and hop out at location B. Regardless of what some folks in the "User Friendly" movement would like to think, most tools require basic instruction in order to be safely used. We can't code away all individual respons…

Spotting a phishing form only seems like "basic instruction" to you because you're highly computer-literate. It's not; it involves understanding at least some of DNS and the difference between hosts, domains and TLDs, URLs, HTTPS, and not to mention certificates and their validity. In your analogy, it's like saying "people shouldn't be allowed to use cars unless they can verify the hydraulic pressure in the master br…

How to spot a phishing form:

1) Did you click a link from an email? 2) Does the page it redirect you to ask for your login info?

You may have received a phishing email. Are either true?

1) You expected this email because you were notified about it from another source e.g. website, support staff. 2) If you login to the website not via the suspicious link, the linked web page does not ask for your login.

If you answered yes, you probably don't have a phishing email.

Re: Oxford Temporarily Blocks Google Docs

#122

Post by Evbn »

rmc wrote: post #99
jacques_chester wrote: post #52

Earlier quoted context omitted.

> Train your users where it is and isn't safe to enter credentials. This demonstrably doesn't work. It reduces but cannot eliminate all instances of phishing. > Don't give your users credentials. Have some alternate way to authenticate them like a login token. Better, but scrounging up a few million pounds for dongles, plus the non-stop cost and effort of replacing lost and stolen dongles, is not easy for a universit…

Better, but scrounging up a few million pounds for dongles, plus the non-stop cost and effort of replacing lost and stolen dongles, is not easy for a university, no matter how famous. Additionally, what OSes will these dongles support? Would you rather "Oxford University bans Windows XP"? or "Oxford University bans iPhones"? etc.

USB HID spec is cross platform.

Re: Oxford Temporarily Blocks Google Docs

#123

Post by thomaslangston »

rmc wrote: post #99
jacques_chester wrote: post #52

Earlier quoted context omitted.

> Train your users where it is and isn't safe to enter credentials. This demonstrably doesn't work. It reduces but cannot eliminate all instances of phishing. > Don't give your users credentials. Have some alternate way to authenticate them like a login token. Better, but scrounging up a few million pounds for dongles, plus the non-stop cost and effort of replacing lost and stolen dongles, is not easy for a universit…

Better, but scrounging up a few million pounds for dongles, plus the non-stop cost and effort of replacing lost and stolen dongles, is not easy for a university, no matter how famous. Additionally, what OSes will these dongles support? Would you rather "Oxford University bans Windows XP"? or "Oxford University bans iPhones"? etc.

Dongles is probably a misnomer here. While dongle probably means something you plug in to authenticate, many two factor auth 'dongles' don't plug in at all. They have a LCD screen that shows a one time use token (6+ digit number) that you enter at the same time as your password.

Re: Oxford Temporarily Blocks Google Docs

#124

Post by pwthornton »

jacques_chester wrote: post #60
pwthornton wrote: post #33

Earlier quoted context omitted.

Yes, they should have known better. Google Docs is used a lot at universities because of its collaborative abilities. If you need to work with several people putting a report together, Google Docs is a great way to get started. We often eventually take it out of Docs into a desktop program to finish it off, but Google Docs is one of the best ways to collaborate. How the IT department didn't know what its students, fa…

> Yes, they should have known better. As they point out, connections to Google Docs are encrypted. There's no way for them to tell what is and isn't legitimate traffic.

There are multiple ways to know what your users are doing, and there is more than just monitoring traffic. They can do surveys and qualitative studies, and they would have then known how widely used Google Docs was.

Lack of knowledge is not an excuse.

Re: Oxford Temporarily Blocks Google Docs

#125

Post by _Simon »

thomaslangston wrote: post #121
marbletiles wrote: post #110

Earlier quoted context omitted.

Spotting a phishing form only seems like "basic instruction" to you because you're highly computer-literate. It's not; it involves understanding at least some of DNS and the difference between hosts, domains and TLDs, URLs, HTTPS, and not to mention certificates and their validity. In your analogy, it's like saying "people shouldn't be allowed to use cars unless they can verify the hydraulic pressure in the master br…

How to spot a phishing form: 1) Did you click a link from an email? 2) Does the page it redirect you to ask for your login info? You may have received a phishing email. Are either true? 1) You expected this email because you were notified about it from another source e.g. website, support staff. 2) If you login to the website not via the suspicious link, the linked web page does not ask for your login. If you answere…

Users don't think like that. They generally don't know what redirect means, let alone recognise when it happens. I'll add that more and more attacks seem to come from trusted sources recently. This only goes to further the issue.

Re: Oxford Temporarily Blocks Google Docs

#126

Post by slantyyz »

TeMPOraL wrote: post #90
alan_cx wrote: post #79

Earlier quoted context omitted.

Oooooooooooooooo rant coming on............. Im sorry, but that is the typical tech reply that blows normal people's minds. Blame the user. Well, the user says, sod that, lets just block the problem and get on with what we wanted to do in the first place. People, normal non tech people, want to use computers as a tool, not become experts in thwarting criminals, etc. If a user cant just go to a computer and simply use…

> Really think about the user. Its they who make computers and the internet worth bothering with. Were the IT dept. folks thinking about the user, they would never have blocked Google Docs in the first place. People want to use tool X, so the job of university IT is to ensure they are able to use tool X . They did exactly the opposite. Also, solutions proposed by GP are reasonable ways to reduce / mitigate the risk o…

Most bureaucratic IT departments (i.e. big corps, govs, schools) tend to be more about the reduction of work for the IT department and less about the best solutions for the users.

Re: Oxford Temporarily Blocks Google Docs

#128

Post by betterunix »

rmc wrote: post #102
betterunix wrote: post #18

Earlier quoted context omitted.

"no alternative way of dealing with the phishing attacks effectively" How about not using passwords? All students, staff, and faculty should have ID cards; start issuing smartcards, and start using cryptographic techniques to authenticate users. Also, digitally sign all official mail, and instruct the users to check those signatures. These are not insurmountable problems. The real issue is that the IT team is not wil…

instruct the users to check those signatures. People fall for 419 phishing scams. What makes you think they are able to check for digital signatures.

Their email client can do it automatically. Basically, you just need to tell them, "Official emails will always have a big, green border around them."

Also, the number of people who fall for 419 scams is fairly low, just barely above the threshold of profitability. The reason people are shocked when they hear that anyone falls for such scams is that hardly anyone does. There is a hypothesis that 419 scams are designed to be obvious, because it helps in filtering potential victims: anyone who would be naive enough to reply is an easy target.

I think a broader problem is that most people are not just unaware of cryptography, but they use an email client that has no support for checking digital signatures. Webmail is by far the most popular email client type, but many popular webmail systems have no support for digital signatures at all, not even checking them for validity. It would be a lot easier to tell people to check for a digital signature if that meant looking for a border color, or a big gold star, or if hovering over/clicking on a link in an unsigned message displayed an annoying warning but no warnings were displayed in signed messages; sufficiently annoying warnings do help in making cryptosystems more effective in practice:

https://bugzilla.mozilla.org/show_bug.cgi?id=460374

Re: Oxford Temporarily Blocks Google Docs

#129

Post by marbletiles »

thomaslangston wrote: post #121
marbletiles wrote: post #110

Earlier quoted context omitted.

Spotting a phishing form only seems like "basic instruction" to you because you're highly computer-literate. It's not; it involves understanding at least some of DNS and the difference between hosts, domains and TLDs, URLs, HTTPS, and not to mention certificates and their validity. In your analogy, it's like saying "people shouldn't be allowed to use cars unless they can verify the hydraulic pressure in the master br…

How to spot a phishing form: 1) Did you click a link from an email? 2) Does the page it redirect you to ask for your login info? You may have received a phishing email. Are either true? 1) You expected this email because you were notified about it from another source e.g. website, support staff. 2) If you login to the website not via the suspicious link, the linked web page does not ask for your login. If you answere…

"Login to the website not via the suspicious link" requires understanding what URLs are, how to isolate which part is "the website", how to edit them and how to enter them. The amount of people Googling for "log into Facebook" proves none of this is a given.

"You expected this email" is also not a hard test to pass in either academia or corporate settings, where users are generally besieged by unsolicted instructions to "Go here, do this, hurry up about it".

Re: Oxford Temporarily Blocks Google Docs

#130

Post by rossjudson »

jacques_chester wrote: post #52
mcherm wrote: post #27

They're attacking the wrong part of the problem. If misleading messages ("phishing") are leading their users to enter credentials onto forms which are then used to send out spam, then the solution is not to block access to one of the sites that supports forms. There are an unlimited number of sites that support forms. There are LOTS of better ways to solve this problem. Here are a few: * Train your users where it is…

> Train your users where it is and isn't safe to enter credentials. This demonstrably doesn't work. It reduces but cannot eliminate all instances of phishing. > Don't give your users credentials. Have some alternate way to authenticate them like a login token. Better, but scrounging up a few million pounds for dongles, plus the non-stop cost and effort of replacing lost and stolen dongles, is not easy for a universit…

Just use more than one outbound mail server. All "normal" mail goes through a server that's rate-limited heavily -- a few dozen an hour, at the most. Bulk email has to be sent through a separate outbound mail server, and there can be much more scrutiny on what goes through that -- because the legitimate "mass mailings" are going to be comparatively rare, and are probably worth having someone take a look at them, to make sure they're OK.
Post reply on HN