Re:Google AdWords Exploit Seen in the Wild
by Godel_unicode on Thursday May 09, 2019 @04:50PM
(#19872290)
Never is a silly standard to measure against.
I'm clearly not saying don't do it at all, I'm saying that this approach won't succeed at anything other than making developers feel like they're Doing Something™. Actual spam filtering and 2fa are examples of real security, showing users the URL is an example of security theater.
The corollary is the nonsensical "security is hard so let's force non-technical users to do it".
I think it’s silly to argue against this. It’s like saying “computer security is hard so why bother at all.”
It’s a continued arms race, where you continue to make things harder and harder. This strategy is working the rate at which people are hacked on platforms like iOS is a fraction of what it used to be like for general computing. There will always be security holes, but you plug them as you find them just as you create mitigation’s against classes of problems to the best of your ability. Why make it easy for the attacker?