@nobody how could you consider yourself a well rounded adult if you don't know entropy?

most of the time is easier to us forget that the vast majority of the population is absolutely oblivious about security.

@ThoriumBR How could you even consider yourself an adult in the first place if you can't understand the math behind calculating entropy? :)

The frustrating part of security is that (unlike silicate chemistry), everybody has to know a baseline if they do anything online

Because of this, defensive security experts have to be much more aware of common misconceptions

and there's a lot of misconceptions

like "never write down a password" and "passwords should be unique"... how am I able to memorize 300+ unique passwords?

The key for defensive security is to keep things as simple as possible. People can't deal with passwords? Find a password manager. People can't keep their software updated? Have the software install updates in the background automatically. People don't notice if they're using unencrypted connections? Start defaulting to HTTPS and warn them if they start to fill out a form on HTTP

secure by default, like openbsd motto

Hopefully we can get our networks to a point where it doesn't matter if people have no idea how security works.

we won't... ever.

one bad written driver, service, or library, and the world ends in flames instead of printing your resignation letter...

the world is moving in the direction that everything is code, and the coders are under time pressure all the time, they copy-paste code without checking what it does...

Yeah, infosec needs to become a part of programming. No way around that.

and no way that will ever happen at large...

time pressures are here to stay, unfortunately

good for pentesters and bug bounties

But for end users, the more things get taken care of by the security architecture of the company, the lower that baseline of knowledge needs to be, and you don't need to spend so much time on education

Like phishing - why leave that up to a half educated user? Block the emails, block the websites, force 2FA using a key that checks the URL, etc. Education can be good, but even the smartest people in the infosec industry can get fooled sometimes. So find a way to stop it without relying on the user.

@ThoriumBR time pressures is why we can't have nice things...

@FireQuacker or why some of us will have nice things

not me, I am not a redteamer nor pentester... I am on the miserable side of this equation

Time and money. Time, money, and effort. Among the reasons we can't have nice things are time, money, effort, and a fanatical devotion to the pope...

@FireQuacker I am trying to find an article from some years ago, a decade or more maybe, that someone sent phishing emails to 10 speakers at DefCon, and IIRC 9 fell for it...

I always try to tell this story and not tell because of the dread [citation needed] that will haunt me back

Yeah, it's funny. Infosec guys can feel so much smarter, and you can come down hard on the end users who clicked on the link and started a ransomware invasion.

...but the infosec guys are humans, too

I have no idea whether I would fall for a phish or not.

I suspect that every person has a few emails that they would fall for, no matter how much infosec they know

I fell once (as far as I know)... new hire back at a company that I left 8 years before, I got an email from someone telling me that I had to access a database to grab my identity files for whatever...

I clicked the link and got the "you got duped!" page, and a stern warning that the next time I would have to attend a security training...

@ThoriumBR I don't have the citation for your story, but I do know that the guy who (literally) wrote the book about social engineering (and started up social engineering village at DefCon) - that guy fell for a phish once

now people on my team send a message on slack teamwide every time they spot those training emails, defeating its purpose entirely

darknetdiaries.com/transcript/69

That guy's story about how he got phished is towards the end, but the whole show is interesting

the book "Predictably Irrational" is amazing, and one of the chapters of the book says that your brain will only perceive what it already expects to perceive... so if you are expecting a mail from the airliner and you get an email that resembles something your airliner would send, you believe

the bank stint as they posed as PCI auditors is hilarious

I love reading those stories, and the "I let myself in" presentation on youtube is amazing too

but it's absolutely out of my character to work those jobs, so it's like watching the NBA or NFL for me... entertaining, but I know I would never ever be able to do anything like those guys do

Yup, same here