Again the "you don't need to know how 'xxxx' works to use it" argument. All these things have single use purposes. They are dedicated to perform set operations and have been refined to do that over many decades. To make this an apples to apples comparison, we need to give the users dedicated applicances to perform single purpose operations; dedicated hardware for communicating (email, IM, etc), browsing, banking, digital photo collection and editing, etc.

Users don't need to know how it works but they do need to understand the effects of operating it in a certain way.

I would have to call this a double edged sword because it has been my experience that inexperienced users are concerned that their every action can and may break their computer, while they still continue to install and execute malicious content.

Users need to come to the realization that their computer serves a purpose, fills a set of needs. Once the computer is configured to satisfy these needs, nothing needs to be installed! If you are not expecting files you should not open/execute that email attachment.

This directly relates to the argument "Users are not stupid; they have lives outside of PCs" - well then why do they seek the satisfaction of finding out what that file is? They have so many other things to do yet somehow find the time to read their 35 spam messages, chain letters, and forwards opening all attachments in case it really was important.



[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/381/33008#33008