Comment by bigstrat2003
5 days ago
> Many people read that and say, "see, that's why I'm never going to use passkeys! I'm safer managing my own backups, and I'm too smart to be tricked into copying and pasting my password to the wrong site." But they're wrong. You are not too smart to be tricked. Nobody is.
It is not remotely difficult to not fall for phishing attacks. I think I've seen one in my entire life which was actually well crafted such that a person might fall for it even if he was paying attention. One. Everything else is the lowest effort slop where all you need to do is hover over the link to see "this does not in fact go to microsoft.com like it claims".
The overwhelming evidence is that this isn't true for the majority of users.
You’re saying the majority of users have fallen for phishing attacks? That seems like selection bias. Since you only see reports about successful phishing attacks and don’t see any reports about all the people who log in safely and successfully every day, you assume a “majority of users” must fall victim to this.
It's actually the other way around - everyone likes to read about clever APT attacks, or zero day exploits, or impressive supply chain attacks. But despite what you may read, phishing attacks are the most important.
Consider: most (over 50%) of company compromises starts with phishing (or with reuse of compromised passwords, which are also usually sourced from phishing). It's even higher for ransomware attacks specifically btw. This means that if we were able to stop phishing and credential theft, we would cut number of cyberattacks by half! That's not something you can downplay.
1 reply →
[dead]