Teaching users is an O(N+T) solution with N users (term comes from time spent teaching), T total time spent on computers (term comes from time spent being cautious).
Oxford Temporarily Blocks Google Docs
131–140 of 160 posts
Re: Oxford Temporarily Blocks Google Docs
#132Earlier quoted context omitted.
Oooooooooooooooo rant coming on............. Im sorry, but that is the typical tech reply that blows normal people's minds. Blame the user. Well, the user says, sod that, lets just block the problem and get on with what we wanted to do in the first place. People, normal non tech people, want to use computers as a tool, not become experts in thwarting criminals, etc. If a user cant just go to a computer and simply use…
I'd like to use my car like a tool. Why do manufacturers make them so difficult to safely operate, I shouldn't require any additional training to operate it, I should be able to just hop in at location A and hop out at location B. Regardless of what some folks in the "User Friendly" movement would like to think, most tools require basic instruction in order to be safely used. We can't code away all individual respons…
> I shouldn't require any additional training to operate it, I should be able to just hop in at location A and hop out at location B.
A taxi is what the end user is looking for when they want to go from location A to location B without specialist training.
Re: Oxford Temporarily Blocks Google Docs
#133Earlier quoted context omitted.
> Train your users where it is and isn't safe to enter credentials. This demonstrably doesn't work. It reduces but cannot eliminate all instances of phishing. > Don't give your users credentials. Have some alternate way to authenticate them like a login token. Better, but scrounging up a few million pounds for dongles, plus the non-stop cost and effort of replacing lost and stolen dongles, is not easy for a universit…
Does two-factor auth have to be that expensive to implement these days? I've experimented with building it against Google Authenticator (free, runs on any modern smart phone) and it's ridiculously easy to get up and running - it's a few lines of Python https://github.com/tadeck/onetimepass/blob/master/onetimepas... Doesn't solve the problem of users without smart phones though, which I imagine is still not ignorable…
With Google Apps itself you can print a list of codes to carry with you. Is that possible with the Open Source/Google Authenticator version?
Re: Oxford Temporarily Blocks Google Docs
#134Earlier quoted context omitted.
Yet they apparently have not implemented 2-factor authentication or rate limiting for students' email accounts... As others have pointed out, there are a few very simple ways to deal with this sort of thing. Rate limiting alone would like take care of the problem. This is probably a simple config update on the smtp server.
they run the mail on Microsoft Exchange I think and I don't think there is an easy way to use 2-factor authentication with Exchange (as opposed to Gmail).
There are numerous solutions for two and multi factor authentication with exchange. PIV/CAC as one example. There are also other soft solutions for 2FA.
Re: Oxford Temporarily Blocks Google Docs
#135Earlier quoted context omitted.
How to spot a phishing form: 1) Did you click a link from an email? 2) Does the page it redirect you to ask for your login info? You may have received a phishing email. Are either true? 1) You expected this email because you were notified about it from another source e.g. website, support staff. 2) If you login to the website not via the suspicious link, the linked web page does not ask for your login. If you answere…
"Login to the website not via the suspicious link" requires understanding what URLs are, how to isolate which part is "the website", how to edit them and how to enter them. The amount of people Googling for "log into Facebook" proves none of this is a given. "You expected this email" is also not a hard test to pass in either academia or corporate settings, where users are generally besieged by unsolicted instructions…
Not huge blame, but browser makers are making it harder to understand what's going on what how to use the web - obfuscating the URL - taking off parts of it, sometimes hiding the entire URL bar altogether.
Similarly, 'cookies' are 'scary' - there's no visual indication in a browser of what's going on with cookies, what they are, what they hold - you have to dig deep in 'preferences' then 'advanced' or 'security'. Instead of easier to use tools, we get legislation around cookies. WTF?
Don't get me started on certificates...
Re: Oxford Temporarily Blocks Google Docs
#136Earlier quoted context omitted.
> Really think about the user. Its they who make computers and the internet worth bothering with. Were the IT dept. folks thinking about the user, they would never have blocked Google Docs in the first place. People want to use tool X, so the job of university IT is to ensure they are able to use tool X . They did exactly the opposite. Also, solutions proposed by GP are reasonable ways to reduce / mitigate the risk o…
Most bureaucratic IT departments (i.e. big corps, govs, schools) tend to be more about the reduction of work for the IT department and less about the best solutions for the users.
Ironic given Google's alleged tardiness in responding to security problems.
Re: Oxford Temporarily Blocks Google Docs
#137Earlier quoted context omitted.
Oooooooooooooooo rant coming on............. Im sorry, but that is the typical tech reply that blows normal people's minds. Blame the user. Well, the user says, sod that, lets just block the problem and get on with what we wanted to do in the first place. People, normal non tech people, want to use computers as a tool, not become experts in thwarting criminals, etc. If a user cant just go to a computer and simply use…
I'd like to use my car like a tool. Why do manufacturers make them so difficult to safely operate, I shouldn't require any additional training to operate it, I should be able to just hop in at location A and hop out at location B. Regardless of what some folks in the "User Friendly" movement would like to think, most tools require basic instruction in order to be safely used. We can't code away all individual respons…
Great example of why Google's driver-less cars will be so successful, overall safer and why we should engineer our systems to remove as much complexity as possible for the users.
Re: Oxford Temporarily Blocks Google Docs
#138Earlier quoted context omitted.
Oooooooooooooooo rant coming on............. Im sorry, but that is the typical tech reply that blows normal people's minds. Blame the user. Well, the user says, sod that, lets just block the problem and get on with what we wanted to do in the first place. People, normal non tech people, want to use computers as a tool, not become experts in thwarting criminals, etc. If a user cant just go to a computer and simply use…
> "train the users" is for me a 30 year mantra that no one out side of geekdom wants to hear Perhaps a better approach to "training the users" might be for the University to actively attempt to phish its own users on a regular basis. Those who fall for the phishing could be contacted directly, or have email access limited for some period of time (for example, a reduced sending rate limit). Making self-phishing a regu…
I worked at a financial place that had people randomly roam around looking for 'open' desktops - people who'd left their computer unlocked. The random people would open MS Word and leave a big message on their screen that they'd been 'caught'. It was lighthearted but made the point, and people who routinely left their systems open were eventually dealt with more harshly.
My 'idea of the month' was to turn down the auto-lock time from 10 minutes down to 1 or 2. Wouldn't eliminate it, but generally, people at their desk were using their computer anyway, so it wasn't a big deal, and if you were called away and forgot, the auto-lock would kick in pretty quickly.
Re: Oxford Temporarily Blocks Google Docs
#139Earlier quoted context omitted.
Oooooooooooooooo rant coming on............. Im sorry, but that is the typical tech reply that blows normal people's minds. Blame the user. Well, the user says, sod that, lets just block the problem and get on with what we wanted to do in the first place. People, normal non tech people, want to use computers as a tool, not become experts in thwarting criminals, etc. If a user cant just go to a computer and simply use…
I'd like to use my car like a tool. Why do manufacturers make them so difficult to safely operate, I shouldn't require any additional training to operate it, I should be able to just hop in at location A and hop out at location B. Regardless of what some folks in the "User Friendly" movement would like to think, most tools require basic instruction in order to be safely used. We can't code away all individual respons…
I love that you put "user friendly" in quotes. As if these products were for somebody other than the users.
Computers have taken over the world precisely because we have worked very hard to make them approachable by mere mortals. The only reason Google matters is that they figured out how to make the search engine much more user friendly. Apple is on top of the world because they made a more user-friendly music player, phone, and portable computer. And we HNers are all getting paid stupid amounts of money because the wide adoption of computing has created high demand.
Nobody is talking about coding away individual responsibility. They're talking about removing another bit of pointless friction from the system, so that the tools are more effective for the tool-users.
And I'll add that cars are heading in exactly the direction that you lampoon. If the car industry had thought like you, they'd still be back on hand-cranking to start the car, needing to maintain the battery's water level, and having to wear goggles. And soon Google will have solved the driving problem, mainly thanks to the way consumer adoption has driven down the costs of computing.
Re: Oxford Temporarily Blocks Google Docs
#140They're attacking the wrong part of the problem. If misleading messages ("phishing") are leading their users to enter credentials onto forms which are then used to send out spam, then the solution is not to block access to one of the sites that supports forms. There are an unlimited number of sites that support forms. There are LOTS of better ways to solve this problem. Here are a few: * Train your users where it is…
Oooooooooooooooo rant coming on............. Im sorry, but that is the typical tech reply that blows normal people's minds. Blame the user. Well, the user says, sod that, lets just block the problem and get on with what we wanted to do in the first place. People, normal non tech people, want to use computers as a tool, not become experts in thwarting criminals, etc. If a user cant just go to a computer and simply use…
My mom told me not to take candy from strangers. Why can't you tell users not to give out their password?
And yes, that means not putting in the password when they click a link. Only when they access the website themselves.