Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Oxford Temporarily Blocks Google Docs

blogs.oucs.ox.ac.uk

Post reply on HN
Print view View original

141–150 of 160 posts

Re: Oxford Temporarily Blocks Google Docs

#141

Post by iopq »

jacques_chester wrote: post #76
blisterpeanuts wrote: post #62

Earlier quoted context omitted.

"phish your own users" Now that's the best idea I've heard all morning. You should be running Oxford's IT dept!

I disagree. At best the users who don't care will continue not to care. At worst it will train users to think "oh, it's another drill, ho hum". Somewhere in the middle is some deeply embarrassed Deputy Vice Chancellor who decides to make those horrid computer people his personal enemies.

Just block the users you phish successfully and tell them their account has been hacked. Then they'll care.

Re: Oxford Temporarily Blocks Google Docs

#142

Post by path411 »

thomaslangston wrote: post #121
marbletiles wrote: post #110

Earlier quoted context omitted.

Spotting a phishing form only seems like "basic instruction" to you because you're highly computer-literate. It's not; it involves understanding at least some of DNS and the difference between hosts, domains and TLDs, URLs, HTTPS, and not to mention certificates and their validity. In your analogy, it's like saying "people shouldn't be allowed to use cars unless they can verify the hydraulic pressure in the master br…

How to spot a phishing form: 1) Did you click a link from an email? 2) Does the page it redirect you to ask for your login info? You may have received a phishing email. Are either true? 1) You expected this email because you were notified about it from another source e.g. website, support staff. 2) If you login to the website not via the suspicious link, the linked web page does not ask for your login. If you answere…

I make it simpler by simply telling anyone to never click any links out of an email.

Re: Oxford Temporarily Blocks Google Docs

#143

Post by huhsamovar »

pfortuny wrote: post #38
betterunix wrote: post #18

Earlier quoted context omitted.

"no alternative way of dealing with the phishing attacks effectively" How about not using passwords? All students, staff, and faculty should have ID cards; start issuing smartcards, and start using cryptographic techniques to authenticate users. Also, digitally sign all official mail, and instruct the users to check those signatures. These are not insurmountable problems. The real issue is that the IT team is not wil…

Your solutions do not take into account the main problem with the security department: budget. There is a huge budgetary crisis in ALL european universities at this moment, including Oxford and Cambridge. I bet if they ask for the resources to implement all those solutions, they will be told: find something at zero cost, I repeat zero-cost. Roger that? Not that I agree blocking google docs is reasonable, just pointin…

>Your solutions do not take into account the main problem with the security department: budget. There is a huge budgetary crisis in ALL european universities at this moment, including Oxford and Cambridge.

False.

Re: Oxford Temporarily Blocks Google Docs

#144

Post by cbr »

davidf18 wrote: post #111
Achshar wrote: post #96

Earlier quoted context omitted.

Can you give an example of how it would work? (online for forms, not offline/IRL)

I haven't thought about it at all as to how Google would fix their problem. Still, they've introduced a component into the Internet ecosystem that has been found to be abusable and they are accountable to install the forcing functions to prevent that abuse. To depend upon user education is simply irresponsible. The idea of forcing functions is well known in organizational/system theory. Another way to think about thi…

This is a very different sort of security flaw than with Java and Flash. Google Forms was allowing users to create forms asking for information and then send links to other people asking them to fill them out. Which is exactly the intent of the program.

When you ask for a "forcing function" you're requesting a way to let people create forms asking for information in general but not letting them ask for information that people aren't allowed to give out. This may be possible, but it is at least very difficult.

Re: Oxford Temporarily Blocks Google Docs

#145

Post by likeclockwork »

alan_cx wrote: post #79
mcherm wrote: post #27

They're attacking the wrong part of the problem. If misleading messages ("phishing") are leading their users to enter credentials onto forms which are then used to send out spam, then the solution is not to block access to one of the sites that supports forms. There are an unlimited number of sites that support forms. There are LOTS of better ways to solve this problem. Here are a few: * Train your users where it is…

Oooooooooooooooo rant coming on............. Im sorry, but that is the typical tech reply that blows normal people's minds. Blame the user. Well, the user says, sod that, lets just block the problem and get on with what we wanted to do in the first place. People, normal non tech people, want to use computers as a tool, not become experts in thwarting criminals, etc. If a user cant just go to a computer and simply use…

Sometimes the user is to blame.

We can't eliminate all possible danger and coat the world in foam rubber because someone people are accident prone.

That's not user-driven logic, that's bureaucrat logic, and pushing for education as a way to mitigate the dangers isn't some kind of 'geek logic' that mainstream people couldn't be bothered with, it's very simple logic.

There are infinite threats. We all have our own whitelists and blacklists.

I don't want to live in a world without electricity, cars, swimming pools, stairs, and knives because some people may hurt themselves, because I may even hurt myself.

Potentially getting fucked over should be in the TOS for human life. Click here to agree or sit in the corner and make collages with non-toxic glue, magazines full of approved harmless imagery, and safety scissors.

Re: Oxford Temporarily Blocks Google Docs

#146

Post by crististm »

path411 wrote: post #142
thomaslangston wrote: post #121

Earlier quoted context omitted.

How to spot a phishing form: 1) Did you click a link from an email? 2) Does the page it redirect you to ask for your login info? You may have received a phishing email. Are either true? 1) You expected this email because you were notified about it from another source e.g. website, support staff. 2) If you login to the website not via the suspicious link, the linked web page does not ask for your login. If you answere…

I make it simpler by simply telling anyone to never click any links out of an email.

Indeed. Links inside emails could be disabled by default. Email clients are already doing this to images. Why not block explicit links as well?

Re: Oxford Temporarily Blocks Google Docs

#147

Post by crististm »

iopq wrote: post #140
alan_cx wrote: post #79

Earlier quoted context omitted.

Oooooooooooooooo rant coming on............. Im sorry, but that is the typical tech reply that blows normal people's minds. Blame the user. Well, the user says, sod that, lets just block the problem and get on with what we wanted to do in the first place. People, normal non tech people, want to use computers as a tool, not become experts in thwarting criminals, etc. If a user cant just go to a computer and simply use…

My mom told me not to take candy from strangers. Why can't you tell users not to give out their password? And yes, that means not putting in the password when they click a link. Only when they access the website themselves.

I guess you can - I see what you mean. But when looking for an answer I found that you're not training children here. You're preaching to grown-ups who are not that^H^H^H^H trainable.

Re: Oxford Temporarily Blocks Google Docs

#148

Post by rmc »

betterunix wrote: post #128
rmc wrote: post #102

Earlier quoted context omitted.

instruct the users to check those signatures. People fall for 419 phishing scams. What makes you think they are able to check for digital signatures.

Their email client can do it automatically. Basically, you just need to tell them, "Official emails will always have a big, green border around them." Also, the number of people who fall for 419 scams is fairly low, just barely above the threshold of profitability. The reason people are shocked when they hear that anyone falls for such scams is that hardly anyone does. There is a hypothesis that 419 scams are designe…

Their email client can do it automatically. Basically, you just need to tell them, "Official emails will always have a big, green border around them."

You then have 2 problems: (a) What email clients will support it and (b) con artists will just put big green borders around their spam emails.

Re: Oxford Temporarily Blocks Google Docs

#149

Post by pja »

Major_Grooves wrote: post #133
simonw wrote: post #118

Earlier quoted context omitted.

Does two-factor auth have to be that expensive to implement these days? I've experimented with building it against Google Authenticator (free, runs on any modern smart phone) and it's ridiculously easy to get up and running - it's a few lines of Python https://github.com/tadeck/onetimepass/blob/master/onetimepas... Doesn't solve the problem of users without smart phones though, which I imagine is still not ignorable…

With Google Apps itself you can print a list of codes to carry with you. Is that possible with the Open Source/Google Authenticator version?

Yes, google-authenticator prints out a list of unlock codes when you run it. You can add extra ones to the file it puts in your home directory whenever you want.

Re: Oxford Temporarily Blocks Google Docs

#150

Post by pja »

slantyyz wrote: post #126
TeMPOraL wrote: post #90

Earlier quoted context omitted.

> Really think about the user. Its they who make computers and the internet worth bothering with. Were the IT dept. folks thinking about the user, they would never have blocked Google Docs in the first place. People want to use tool X, so the job of university IT is to ensure they are able to use tool X . They did exactly the opposite. Also, solutions proposed by GP are reasonable ways to reduce / mitigate the risk o…

Most bureaucratic IT departments (i.e. big corps, govs, schools) tend to be more about the reduction of work for the IT department and less about the best solutions for the users.

Since IT departments are generally regarded as cost centres & therefore they are usually either understaffed or expected to keep costs to the absolute minimum by upper management this is hardly surprising.

In this particular case, the department is in a double bind: the success of phishing emails threatens the ability of the university to send email to many other major hosts on the net. If you sat the users down and asked them which they need more, a reliable email to people outside the university or access to Google Docs, then the decision isn't so clear cut all of a sudden is it?

Post reply on HN