Have people really got this stupid...?

[scaryjim]

Just received an email today from Avast! They have kindly emailed me a patch for my anti-virus software that I should apply immediately "due to the new malware circulating over the net".

Now, I have a pretty low opinion of humanity in general, and the intelligence of the general population in particular, but even I think this one is insultingly obvious. Are people really daft enough to run things like this?

And if so, how long before some friendly white-hat decides to spam out an email with an *actual* anti-virus package in it? Sure;y that's the obvious next step in the fight against idiocy

[mikeo01]

*turns out to be true*

Na but it's obvious who it targets, computer illiterate people may actually fall for it. Same reason some people fall for letter scams.

Some people can't get their heads around that "it isn't real".

I do feel sorry for some people, I know a few, they just don't get the whole computer thing and how it connects etc etc, like they're in a protected bubble

[Saracen]

Have people really got that stupid? Nope .... some have always been that thick.

But there's a quandary, isn't there? Just how cautious should you be? Just how many precautions do you take?

Where does "sensible" end, and "paranoid" start?

And, what risks are you taking precautions against? A virus being a nuisance, and perhaps a format/restore causing some data loss, but ultimately, no great problems? Or ransomware encrypting all your data files before you even find out it's there? Or crooks getting data for ID theft?

There are a variety of levels of threat, and the potential level of damage depends on exactly what you do with your PC, so one person's "sensible" is another's "paranoid", or conversely, one person's view of risk is such that his "sensible" is another's "thick", for taking the risk.

Clearly, some attempts to infect are clumsy, and you have to be either naive or careless to fall for it. An example would be the number of emails I've had from (apparently) my bank, usually (apparently) from a bank that I do not, and never have had, any account with. Or Nigerian princes kindly wanting me to hold their millions for them.

But some threats are far, FAR more subtle, and can be really rather clever pieces of social engineering. An example would be the current best theories of how Stuxnet got past an Iranian airgap.

I guess the logic is, even for "thick" attacks, you only need a tiny fraction of one percent to fall for it and you can make thousands. Or more.

I mean, I still hear of people receiving cold calls from "investment advisors" offering "exceptional" returns on stocks, or property deals, etc. And apparently bright and sensible people still fall for it. Why? A slick sales pitch, and inate greed, would be my bet.

My attitude, on the other hand, is probably what people would regard as closer to paranoid. For instance, some bloke knocked on my door a week or so ago, claiming to be a local builder, offering "free" home insulation. The wife started to listen to his pitch .... until I got there. My attitude is that if you knock on my door, I don't care who you are, what ID you have, or what the offer is, I'm not interested, so go away. The "go away" will be polite, at first, but is going to rapidly deteriorate into far less than polite if you persist. And that applies to ALL people banging on my door offering something, from Jehovah's witnesses, to door-to-door salesmen, to charity collectors (or those claiming to be, anyway).

That insulation saleman might have been genuine, and the offer might have been good. But I don't care. I don't want ANYONE, except friends, family and genuine personal visitors or those with a legit commercial reason (like, e.g. meter readers) banging on my door. If I want insulation, I'll go find a company I want and trust, to do it, even if it means paying for it.

And the same sort of "paranoia" applies to email, with bells on. I will not EVER click links or run attachments received in email, even (apparently) from people I know, unless I know what the email is, and was expecting it, at that time from that person. Also, my email package is set to ignore HTML code and not to even display pictures.

Paranoid? Maybe. But it's as safe an attitude as is practical and pragmatic for me.

[mikeo01]

You're basing this because you understand technology. If you put yourself in someone else's shoes and ask "Why wouldn't this email be genuine?" then you'll see.

It's all about educating people who use computers. Quite frankly the majority of people couldn't give a damn in the file type, size, code etc because that's all jargon; they see an email from say a bank (say their bank) so why would they question it?

I think people are not thick, just many people don't really *get* technology. For instant if someone explained some complex science jargon about rockets (unless you know science ) you'd go "Don't understand. Can we press the big red button still?".

It's all about information out there and learning about technology. And the truth is there's probably a lot more people who just use the Internet willingly that ones that do not.


Obviously there's common sense involved but to one's eyes a simple say PayPal email saying "click here to reset your password" may not set off alarm bells. You can't be paranoid if you don't understand what to be paranoid about

Especially the elderly and older generations. So I wouldn't like to call someone thick for it, I'd like to treat it as "uneducated" or "aware of the dangers".

[scaryjim]

You're basing this because you understand technology. If you put yourself in someone else's shoes and ask "Why wouldn't this email be genuine?" then you'll see.

Surely the question should always be "why would this email be genuine"? That's usually a much easier question. The paypal one is actually much more understandable, because if you have a paypal account, you're probably used to getting email from paypal. Plus the paypal spoofs are actually getting quite subtle and well-written nowadays. Whereas this one was "We're from Avast, here's an update". Unless Avast are in the custom of sending important AV updates out by email, I just don't see where that one could *start* to be genuine....

... A slick sales pitch, and inate greed, would be my bet.

As Moist von Lipwig says, you can't con an honest man...

[Saracen]

You're basing this because you understand technology. If you put yourself in someone else's shoes and ask "Why wouldn't this email be genuine?" then you'll see.

It's all about educating people who use computers. Quite frankly the majority of people couldn't give a damn in the file type, size, code etc because that's all jargon; they see an email from say a bank (say their bank) so why would they question it?

I think people are not thick, just many people don't really *get* technology. For instant if someone explained some complex science jargon about rockets (unless you know science ) you'd go "Don't understand. Can we press the big red button still?".

It's all about information out there and learning about technology. And the truth is there's probably a lot more people who just use the Internet willingly that ones that do not.


Obviously there's common sense involved but to one's eyes a simple say PayPal email saying "click here to reset your password" may not set off alarm bells. You can't be paranoid if you don't understand what to be paranoid about

Especially the elderly and older generations. So I wouldn't like to call someone thick for it, I'd like to treat it as "uneducated" or "aware of the dangers".

Up to a point, I agree with you. Which is why I also referred to naive or careless.

But, the same mindset that causes people to trust an email is from their bank just because it claims to be is the same mindset that causes people that are generally bright to fall for an unsolicited telephone call from a boiler room scam. Ir that trusts an "offer" from someone knocking on your door, because they're pleasant and well-dressed.

You say why would people question an email us from their bank? If I knocked on their door, claimed to be from their bank, and asked for their bank account details and their signature on blank sheets of paper, would they take my word for it? Or would they consider it stupid to hand those details over?

Yes, it may be harsh calling it thick, and naive might be better. But I could also assert that if you use a technology you don't understand and then hand over your bank details without seriously questioning it, then it is a bit thick. If you don't understand the risks of internet-enabled banking, don't bank via the internet. After all, there's an element of personal responsibility in all this, too.

And by the way, while the proportion of "older" people lacking computer literacy may be higher, age is no bar to computer literacy, and I know people that touched their first compyter in the mid 60's, to end up stripping, building and configuring them, with all sorts of software, well into their 80s, and one lady that was well in her 80s when she found eBay, Amazon and social media sites, and then there was no holding her back.

It's not age that is the bar, but lack of experience .... and interest.

[Saracen]

....

As Moist von Lipwig says, you can't con an honest man...

I've seen the same assertion from different sources. It might be a bit simplistic, but it's FAR harder, that's for sure. Also, if it looks too good to be true, it probably is.

[mikeo01]

That's true, I do agree it's people's responsibility too the Avast one is a bit silly to be fair; that one should be spotted

But nowadays people can phone up an ISP and say "Can I have Internet?", ISP's reply "Of course, here's the Internet and the most basic router setup in the whole world with no real strong protection; oh by the way here's a naff security suite that'll protect you for the baddies". OK may be a bit harsh on ISPs but it's somewhat true, they put trust in their ISPs if they don't understand technology. They simply think this "Anti-virus" protects against all things bad.

Of course it's on their behalf as well but ISPs for example should really be more informative to the people who simply haven't the knowledge.


Take the Outlook advert, they promote they are "Private" and won't send our email addresses out; so to most people they simply think great only genuine people will email me without realising.


I believe there should be common sense + company's making a bigger deal. For instance loads of people do Internet banking but I bet they don't quite get why it's safe or why it isn't.


Bottom line it's a 50/50 responsibility. People need to use common sense, but at the same time company's should provide the necessary information because most people don't really know what they are looking for in terms of "safety" because it's technology jargon to them.

But yes I do agree with most of what you are saying


EDIT: About the age thing, I didn't mean older people are less intelligent I just mean they are targeted due to the lack of experience. Which is awful

[Traldera]

If my mum got this email she would install it.

Was chatting to her yesterday and antivirus came up:

Me: Have you got antivirus?
Her: Yes of course! I got it with the laptop
Me: Oh good, which one?
Her: Microsoft Office

No, I'm not making that up. How the hell did I grow up to have an MSc in computing with genes like that in my blood?

[mikeo01]

I think the question we should all be asking is: Why is there so many nasty people in the world? Why Why Why. I really don't understand what goes on in people's heads. Why would you want to deceive someone.

[TooNice]

the Avast one is a bit silly to be fair; that one should be spotted

I am not so sure. I'd worry if my folks receive this email. I am not sure what AV they have on their computers, but it happens to be running AVAST, I am not convinced that they will necessarily know that is not customary for AV companies to send emails of this nature. I do wish that webmail providers display the full header by default so that I can get them to check look at it each time.

I may not fall for this kind of things, but I wouldn't consider myself smarter. They are the ones running several profitable businesses, not me. And, perhaps ironically, they've also succeeded in countries where you do have to watch out for non-electronic scams.

Familiarity of the environment and customs will affect how we guard ourselves. I might even say that it is a bit sad that we've come to the point that we have to constantly be on the looking out for those things and failing to do so is deemed indicative of one's intelligence..

[wasabi]

If my mum got this email she would install it.

Was chatting to her yesterday and antivirus came up:

Me: Have you got antivirus?
Her: Yes of course! I got it with the laptop
Me: Oh good, which one?
Her: Microsoft Office

No, I'm not making that up. How the hell did I grow up to have an MSc in computing with genes like that in my blood?

My old boss (Head of IT in a big company) came in saying that Windows wasn't installed on his new laptop. He meant Office, and no it wasn't a slip of the tongue.

[mikeo01]

I think we need to look on a broader scale too; it's not all desktops. We've got tablets, phones, games consoles, all these are prone.

Loads of people use smartphones and loads of people check emails on their smartphones. The dangers are shifting so quite rightly no technology or no one is really fully safe. It's on a huge scale

Emails are the easiest but smartphones now include "Adverts" which are integrated into applications for example.

The simplest things are the most dangerous sometimes

[Saracen]

My old boss (Head of IT in a big company) came in saying that Windows wasn't installed on his new laptop. He meant Office, and no it wasn't a slip of the tongue.

Not so long ago, I had to point out to a friend that his wifi was totally open, and therefore an ideal opportunity for a paedophile to piggyback his kiddy porn downloads, or a terrorist to plan his next attack. And he's an IT Security Manager at a bank. So, okay, his home wifi isn't exactly a major corpirate risk, but even so .... :-[

[Saracen]

I think we need to look on a broader scale too; it's not all desktops. We've got tablets, phones, games consoles, all these are prone.

Loads of people use smartphones and loads of people check emails on their smartphones. The dangers are shifting so quite rightly no technology or no one is really fully safe. It's on a huge scale

Emails are the easiest but smartphones now include "Adverts" which are integrated into applications for example.

The simplest things are the most dangerous sometimes

And, allegedly, TV's. LG currently in the spotlight, even when the privacy options are enabled, and Samsung a couple of years back. If they're at it, you've got to wonder about Sky and Virgin etc settop boxes. And suggestions of cameras in TVs to identify how many people, and their age/gender, in the room, to "tailor" adverts.

If they seriously think that's acceptable to the vast majority, they need their heads examined.

But .... kinect, etc? What, exactly, could that be doing without us being asked/told? Or could it start doing, once the installed base is high enough.