Re:The 'bogus boss' email scam costing firms millions
by pbhjpbhj on Friday January 08, 2016 @12:15PM
(#10866435)
But shouldn't one's email program handle all that in the background, so you get the equivalent of a browser's padlock icon showing whether authentication has been successful rather than getting the PGP (or whatever). Yes, there will still be ways around people but this seems like it should be a standard and basic part of all email programs now.
Re:The 'bogus boss' email scam costing firms millions
by noxToken on Friday January 08, 2016 @03:03PM
(#10867771)
This is probably the most elegant solution to a PGP signature.
> this seems like it should be a standard and basic part of all email programs now
I can't speak with authority on this, but it feels like this would be adding overhead to something that doesn't necessarily need it. Email is supposed(!) to be relatively simple. I can think of many cases where you would definitely want to have PKI integrated into your emails, but I can think of just as many cases where it's unnecessary overhead in email clients as a standard. However, I admit that I could be wrong.
Re:The 'bogus boss' email scam costing firms millions
by wolfgke on Friday January 08, 2016 @12:53PM
(#10866727)
I agree that it would make sense to add this functionality to the core of the email program. But this is a UI problem (i.e. it makes things that have been understood more comfortable), but does not change whether or not you have understood what a signature means.
Re:The 'bogus boss' email scam costing firms millions
by GFischer on Friday January 08, 2016 @01:04PM
(#10866812)
Just the other day there was an article on Kevin Mitnick, this kind of attack is a malicious version of what he used to do ("Social Engineering")
https://news.ycombinator.com/item?id=10796950
http://henrikwarne.com/2015/12/27/social-engineering-from-ke...
It's the same reason why email accounts have 2,000 unread inbox messages or 30 notifications at the top of their phone. You get so used to seeing the notification that you begin to ignore it. In this case, you see a string of non-readable text that makes up some weird "signature" at the bottom. The conclusion? "Oh. The signature is there. It's been authentic every other time I checked. Why wouldn't it be authentic on the 101st check?"
Humans are the hardest vector to defend in an attack. Never underestimate the laziness of people - even when a simple solution exists to combat the problem at hand.