@mattblaze point #4 from someone who forgot far more about security than they will ever know https://hachyderm.io/@shortridge/111784865253206399 I’m in a reflective mood this week and it’s kind of wild to me that I’m known as a “provocateur” in #cybersecurity for takes like:

💡 don’t shame victims

💡 UX matters, a lot

💡we should understand what we’re supposed to protect

💡 if someone clicking a thing on the thing-clicking machine leads to security failure, they are not the foolish one

💡 the best things a security program can invest in aren’t in the RSAC vendor hall

💡 maybe we should start actually proving outcomes??????????

¯\_(ツ)_/¯

@mattblaze I just don't know how to square this with requirements coming from the business that significant actions occur from a single click on a link in an SMS. I barely got them to let me do the GET -> JavaScript -> POST dance that will at least prevent preview/prefetch from breaking things.

Users have to read and understand before triggering something significant (i.e. clicking), right?

@mattblaze I've done a lot of different (and popular) security awareness training classes, and most of them spend a bunch of time explaining how to recognize a phishing URL.

I always roll my eyes, because I've been working in security/exploits for years and years, and I'm not sure I could recognize 100% of malicious URLs (not to mention the various ways to hide URLs, open redirects, etc etc)

@mattblaze Complicated further by legit companies sometimes using shady-looking short links themselves. Someone in my house got a legitimate Australia Post delivery text that included a link to something like auspo.st and we all thought it was a scam because we'd never seen it before.

Looked it up online and it was their real shortened URL lol.

So even "shady-looking URL" isn't a consistently reliable heuristic on top of the usability problem you've brought up.

@mattblaze
Don't get me started. Apart from the victim blaming this simply doesn't work because companies use the weirdest URL schemes for marketing purposes (to track click) and even security tools are contributing to the issue. E.g. ti find the real URL behind a Safe Link in Microsoft Defender for Office 365 isn't trivial

🤬​

@pcbeard https://hachyderm.io/@shortridge/111784865253206399 I’m in a reflective mood this week and it’s kind of wild to me that I’m known as a “provocateur” in #cybersecurity for takes like:

💡 don’t shame victims

💡 UX matters, a lot

💡we should understand what we’re supposed to protect

💡 if someone clicking a thing on the thing-clicking machine leads to security failure, they are not the foolish one

💡 the best things a security program can invest in aren’t in the RSAC vendor hall

💡 maybe we should start actually proving outcomes??????????

¯\_(ツ)_/¯