<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<div class="moz-cite-prefix">On 4/21/25 7:15 PM, John Levine wrote:<br>
</div>
<blockquote type="cite"
cite="mid:20250421231547.D6B01C590667@ary.qy">
<pre class="moz-quote-pre" wrap="">No, that's not the reason. Endless failures have told us that trying
to train users just does not work.</pre>
</blockquote>
<p>We have never tried. </p>
<p>First there <i>is</i> a powerful contingent that insists that
only a technical solution is acceptable and it is wrong to try to
educate. Literally, I have heard this argument repeatedly, they
call any education blaming the user. Trying to teach people to
swim when there is a crowd screaming that swimming is impossible
is hard.<br>
</p>
<p>Second, when we have tried to educate we have done it terribly.
One job I had, at a company with almost all technical employees,
spent a lot of money for some fancy training program for new hires
about phishing, and it was entirely based on superficial aspects
of e-mails, things like how good the spelling is or whether there
was a contrived urgency. Never did they mention things like "Where
did the e-mail come from, is it where the e-mail pretended to come
from?" or "Do the links in the e-mail match the purported
sender?". Never did they advise to not enter authentication
credentials in response to a link in an e-mail, to instead log
into the account in question using a known good URL, and then
click in the e-mail link that pretends to be for that account.<br>
</p>
<p>But they could <i>not</i> train on these aspects, because the
company itself sent legitimate e-mails that looked like phishing.
They hired services that sent e-mail to new hires that pretended
to be from one entity but were sent by another. And they sent
e-mails where there was no way to independently login other than
via the link in the e-mail.<br>
</p>
<p>I currently have at least one account with a bank that sends me
e-mails where I have no choice but to type login credentials in
response to an e-mailed link.</p>
<p>We are doing anti-training by sending non-phishing e-mail that
looks like phishing.<br>
</p>
<p>Third, even if we had done some decent user education, it would
take time and would be imperfect…handy excuses for arguing "just
does not work".</p>
<p><br>
</p>
<p>Building insecure systems is <i>profitable</i>. Companies that
have had <i>massive</i> breaches only have little blips in their
business. Look at Crowdstrike, did their failure last July hurt
their stock price for more than a few weeks? No! Of course user
education isn't important enough to actually do. <br>
</p>
<p>-kb<br>
</p>
</body>
</html>