Comment by wahnfrieden
9 hours ago
Sometimes attacks happen from users being instructed to enable settings in order to achieve something regardless of whether you’d expect them to have a reason to use the setting
9 hours ago
Sometimes attacks happen from users being instructed to enable settings in order to achieve something regardless of whether you’d expect them to have a reason to use the setting
Sure, sometimes people get social engineered into taking money from their bank account and giving it to criminals. Should banks stop allowing withdrawals?
In Sweden the answer was yes.
[dead]
If someone is willing to click on build version 5 times and then gets a mystery prompt about dev mode, and still goes along with the next 4 steps I think they were gonna get hacked a billion different other ways
The solution to social engineering can't be to remove useful features - you can socially engineer people to do literally anything, you can have someone walk to their bank, withdraw cash & fly to you with it with a dating scam: there are literally no boundaries once you get into that area of security. Digitally, you combat that through UX, messaging & education.
Then maybe the best course of action is Google adding a warning before enabling certain settings that help normies avoid these attacks.
Along the lines of "Are you being asked to do this by someone else? Be cautious, as your device could become compromised."
Nobody reads the warnings and getting to use ADB on a phone is already a quest of epic proportions, soon to become the next Monkey Island sequel.
its ridiculous how many people will ignore the warnings and relay the security challenge/solution to the attacker.
"we will never ask for this over the phone" takes second place to:
"we will send/save you money/time if you make it convenient"
dress it up to taste like developer needs, and you can hook the newbies.
> "we will never ask for this over the phone" takes second place to:
Doesn't help that the banks then do, in fact, call you, and ask for this over the phone.
1 reply →
Sometimes people fall down the stairs in their own homes. That doesn't mean the government should mandate everybody to wear helmets at home does it?
A measure needs to be in proportion to the actual risk it seeks to mitigate.
I am not in favour of limiting adb access, but this does beg the question, how many accidents would it take to cause enough overfull ERs to make the requirement of staircase railings a thing, in order to make sure there are doctors to treat other things than broken bones. uh happy Saturday.
In many jurisdictions, staircase handrails are required[1] in residential homes.
And even when they are required, it's up to the person using the stairs to determine whether they wish to elect to use the handrail or not.
[1]: IRC R311.7.8
Well in my book it is a cost vs benefit question. Handrails are not expensive in comparison to a medical procedure, nor are they particularly hindering in the daily use of the stairs. In fact, quite the opposite: anybody who uses stairs without handrails may find themselves temporarily disabled, e.g. if a circuit breaker tripped and you have to walk down the stairs in the dark.
That means, handrails cost little and have nearly no downsides. Which is why I used helmets as a metaphor. The proposed restrictions has a lot of downsides to deal with a mostly theoretical risk.
I think that these victims are paid by the likes of Google to create a precedent. It is unbelievable stupid scheme to fall to.
While I certainly think we should not be taking features away from people just because there exist people who will let themselves be social-engineered through arbitrary hoops, don't go creating wild conspiracy theories to explain something that supports much simpler explanations instead.
It's easy enough to imagine that Google is trying to fix something they see as a problem, and not caring about the developer case rather than specifically seeking to destroy it.
When Apple fixed security issues that allowed for jailbreaking, they weren't doing it specifically because people use it for jailbreaking, they were doing it because it was a security issue.
We should have 100% control of our own devices. But we should have it by design, in a fashion that makes sure that we control them rather than other people.
... and it is stupid to try to protect cretins who would do that by screwing everybody else.
[dead]