Over the last few weeks, we\u2019ve been looking at various aspects of online security. It\u2019s a big topic, and it\u2019s often difficult to be clear about what\u2019s happening, and what\u2019s at stake. This week we\u2019ll try to provide a few basic ideas about how to judge what makes us safer and what doesn\u2019t.<\/p>\n
We rely exclusively on our senses to assess the presence or absence of threats in the world around us. When we get up in the morning, we check the bread we eat for mould, sniff the milk before adding it to the tea, and touch the edge of the mug with our lips before drinking, to make sure it\u2019s not too hot. We look both ways before crossing the road and we listen for oncoming traffic. We hesitate to get into a bus that doesn\u2019t look safe. We cover our mouth and nose if there\u2019s too much dust or smoke.<\/p>\n
We employ our senses in a multitude of ways without any conscious thought. All the while, in the background, the brain is taking everything in and deciding from one moment to the next how to react to each new situation. For most of us, a typical computer gives us exactly nothing to react to. All we see is a pretty background, a few flashing icons or blinking lights and the Solitaire game in front of us.<\/p>\n
\nWhen a geek looks at a computer, she sees at a glance what\u2019s happening inside. Those pretty icons are translated into visual clues to the immensely complex interactions happening in the guts of the computer. The blinking lights are like Morse Code, shorthand missives summarising the goings-on in this labyrinth of complexity.<\/p>\n
It may look a little uncanny to a normal person when a computer professional does little more than glance at their PC, then announces with perfect assurance that the shnizzle booster needs to be refabulated immediately, or the pernificator won\u2019t survive the week.<\/p>\n
It\u2019s all context and experience, of course. To the average person, a computer consists of a screen that sometimes displays what the user wants to see, a keyboard and mouse that sometimes allow them to do what they want and a magic box that never does what they want, but without which the screen, keyboard and mouse cease to function.<\/p>\n
If computers are so inscrutable, how are we ever supposed to know when it\u2019s safe to give out our email address, to enter our username, password and credit card number? How do we read the onscreen cues and interpret them properly?<\/p>\n
To some degree at least, we need to trust someone to tell us. But knowing who to trust is a remarkably difficult. Bruce Schneier, a widely recognised security expert, borrows from economic theory to state that our inability to see what\u2019s happening inside the computer has created a \u2018Market for Lemons\u2019.<\/p>\n
Says Schneier:<\/p>\n
\u201cA used car market includes both good cars and lousy ones (lemons). The seller knows which is which, but the buyer can’t tell the difference — at least until he’s made his purchase…. This means that the best cars don’t get sold; their prices are too high. Which means that the owners of these best cars don’t put their cars on the market. And then this starts spiraling. The removal of the good cars from the market reduces the average price buyers are willing to pay, and then the very good cars no longer sell, and disappear from the market. And then the good cars, and so on until only the lemons are left.\u201d<\/p><\/blockquote>\n
His conclusion:<\/p>\n
\u201cIn a market where the seller has more information about the product than the buyer, bad products can drive the good ones out of the market.\u201d<\/p><\/blockquote>\n
Good security software should be like a well-built house. Once the foundation is laid, the walls raised and the doors and windows hung, we shouldn\u2019t have to worry about these things again. Install the software, configure it sensibly and let it be.<\/p>\n
That should be all there is to it. Updates? Automatic, of course. Firewall? Sensible enough to know the difference between an invitation circulated to friends and spambot activity. Nobody wants software that behaves like a yappy dog barking its brains out every time someone passes the gate. Nobody wants the lazy dog either, too dense to realise that the shadowy figure slipping over the fence might be a threat.<\/p>\n
The problem is, yappy and lazy dogs are all we seem to have these days. The folks in the Marketing departments of security software makers realised early on that they\u2019d have a hard time selling software that doesn\u2019t appear to do anything. So they created software that focuses more on the appearance of security than on actually providing it. The result is intrusive pop-ups warning us about passers-by on the road and nothing about the burglar in the back yard.<\/p>\n
In other words, we buy software that looks like an orange but tastes like a lemon.<\/p>\n
What\u2019s to be done, then? If all we have to go by is the skin, how do we tell whether the fruit inside is sweet or bitter? It\u2019s all about knowing who you can trust. This requires a healthy dose of cynicism mixed with a little bit of education.<\/p>\n
Do not under any circumstances assume that whatever everybody else is using is going to be sufficient. We\u2019ve already mentioned that the software market encourages lemons, so we can\u2019t assume that a given product is good just because it\u2019s popular. In most cases, this is simply not the case.<\/p>\n
Don\u2019t ask just anyone what security software they use. Ask them first whether they get a lot of viruses, and whether their computer runs well for them. If they answer the first two questions adequately, then you can consider asking them what they do to secure their computer. What you\u2019ll likely hear will be as much about safe practices as about software protections.<\/p>\n
Another useful metric is the number of icons visible on the desktop and in the system tray. If a user has hundreds of icons visible and dozens of applications running simultaneously then there\u2019s a good chance that they\u2019re not picky about what they install on their computer.<\/p>\n
What about when you\u2019re shopping for a new computer or new software? How do you know when you\u2019re being sold a bill of goods?<\/p>\n
First, consider the salesman\u2019s motives. With a little care and attention, it\u2019s possible for even the most computer-illiterate to discern whether the vendor is selling you an orange or a lemon. Listen to the interest (or lack thereof) in his voice. If someone can\u2019t briefly explain in plain English precisely what the thing does, what balance is maintained between security and usability, and most importantly what details to watch out for, then odds are they don\u2019t have what you want.<\/p>\n
Anyone who simply waves his hands and tells you that their product will do everything you want is being less than generous with the truth. Conversely, anyone who immediately overwhelms you with a barrage of geek-speak hasn\u2019t given enough thought to how mere mortals are going to live with what they\u2019re proposing.<\/p>\n
Quite often the best software is simply given away, rather than sold. This may sound strange, but it makes sense. Programmers who care more about keeping their systems running well than about making money are often inclined to share their code with other like-minded developers. Everybody contributes a little and gets a lot. The only way this kind of process works, though, is if the software itself is free.<\/p>\n
A lifetime of experience dealing with computer security issues has made one thing clear: It\u2019s more about education and awareness than it is about the tools. There\u2019s no substitute for taking the time to inform yourself about the threats that exist and how to avoid them. As with all things, an ounce of prevention is worth a pound of cure.<\/p>\n
And who knows \u2013 you just might find that those dancing icons and blinking lights actually mean start to mean something.<\/p>\n","protected":false},"excerpt":{"rendered":"
Over the last few weeks, we\u2019ve been looking at various aspects of online security. It\u2019s a big topic, and it\u2019s often difficult to be clear about what\u2019s happening, and what\u2019s at stake. This week we\u2019ll try to provide a few basic ideas about how to judge what makes us safer and what doesn\u2019t. We rely […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2,5,10],"tags":[326,346,420,446,504,540],"class_list":["post-1768","post","type-post","status-publish","format-standard","hentry","category-geek","category-journamalism","category-soft-core","tag-lemons","tag-market-for-lemons","tag-oranges","tag-pernificator","tag-refabulated","tag-shnizzle-booster"],"_links":{"self":[{"href":"https:\/\/village-explainer.kabisan.com\/index.php\/wp-json\/wp\/v2\/posts\/1768","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/village-explainer.kabisan.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/village-explainer.kabisan.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/village-explainer.kabisan.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/village-explainer.kabisan.com\/index.php\/wp-json\/wp\/v2\/comments?post=1768"}],"version-history":[{"count":0,"href":"https:\/\/village-explainer.kabisan.com\/index.php\/wp-json\/wp\/v2\/posts\/1768\/revisions"}],"wp:attachment":[{"href":"https:\/\/village-explainer.kabisan.com\/index.php\/wp-json\/wp\/v2\/media?parent=1768"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/village-explainer.kabisan.com\/index.php\/wp-json\/wp\/v2\/categories?post=1768"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/village-explainer.kabisan.com\/index.php\/wp-json\/wp\/v2\/tags?post=1768"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}