Email scam this morning. Not the usual.

[usonian]

Supposedly from "ID.Gov !!"

Oops, that's an invalid email address no matter what, but if you can hover over the supposed sender address, or right click or control-click (depends on your email program), then this shows up.



RIGHT, an email address in Japan, trying to look like id.gov

I looked for a "Phishing for Dummies" guide to share with relatives and friends that covers basics in a not-too-technical way. It turns out that Cisco gives away a PDF with exactly that same name (1) , but (surprise) has a lot to say about Cisco security products you can buy ---It's for IT professionals.


This comes the closest, as of this morning's search.

https://www.pcmag.com/explainers/how-to-spot-and-avoid-phishing-scams-5-tips-from-our-security-expert

(1) https://www.cspire.com/content/dam/final/documents/whitepaper/Phishing%20for%20Dummies%20eBook.pdf

[dickthegrouch]

1. Financial organizations are quite good at disseminating advice for non-experts

My bank has a whole Security Learning Center which is quite good
https://www.bmo.com/en-us/main/personal/security-center/learning-center/
(curiously it won't even display unless I deactivate my VPN, but they're trying).

Of course, like everything else, it requires people to have an attention span of more than 30 seconds, and understand the language.

Many people don't even know they are using a browser, far less what "mousing over an email address to read the domain name" means.

Even when I tell people explicitly what I want them to do as I diagnose some issue, they don't pay attention and do something different. The classic on this was many years ago when I told a customer (on the phone) to type "shutdown", he actually typed "reset" and then claimed the problem was still manifesting. I had him type "shutdown" again, and this time I only heard 5 characters being typed. I asked "What did you type" he said "reset". I had him actually type "shutdown" and the problem 'miraculously' disappeared. Then of course I tried to explain the technical difference between the two, but he wasn't interested.

Getting back to today's cybersecurity - I have always maintained that it's far better to have the computer do things humans have trouble with (repetitive, or complicated procedures), the Cybersecurity community IMHO has signally failed to enforce that in the programming so far.

It's actually quite disgusting that the un-trained user still has to perform so much of their own protection. For 40 years cars have had seat belts. Computers are equally ubiquitous and have barely any inherent protections for those untrained users, even after 40 years of destructive and dangerous experiences.

[usonian]

2. No argument.

All effort goes into "feature explosion" and not into reliability and ease of use, and I've been there since the beginning.

It just gets worse.

I email a friend whose company uses a filter on all emails, but it sure ain't free.

At least the above example was in the junk folder, (via comcast) being so easy to spot, but most people are zero-savvy.

I just tell relatives to "ask me first" when in any doubt at all.

[JMCKUSICK]

3. Thank you Usonian

[usonian]

4. As noted, this is all rather opaque to the average person, and that's really bad.

People get taken, and AI makes the attacks cheaper, more numerous and slicker.

Safe Computing, John!