Re: [saag] SHA-1 to SHA-n transition

[Jeffrey Hutzelman <[e-mail]>]

--On Monday, March 02, 2009 12:25:47 PM -0600 Nicolas Williams 
<[e-mail]> wrote:

> On Mon, Mar 02, 2009 at 01:19:13PM -0500, Jeffrey Hutzelman wrote:
>> --On Monday, March 02, 2009 11:11:22 AM -0600 Nicolas Williams
>> <[e-mail]> wrote:
>>
>> > It will be a long time before users can be trained not to type
>> > passwords into attacker-controlled dialogs -- that is definitely true.
>>
>> No, no.  It's a long way down the road to the chemist's.  It will be
>> _forever_ before users can be trained not to type passwords into
>> attacker-controlled dialogs.  We've been trying for decades, and some of
>> the users in question have _been here_ for decades, and the message
>> still  hasn't gotten through.
>
> Mostly because the technology to move beyond application-controlled
> dialogs has not been deployed or the technologies that have been have
> been unsatisfactory.

No, it has nothing to do with the technology.
As long as users have a password, they will give it to anyone or anything 
that asks for it.  You'll get through to some of them that they shouldn't 
give their password away, but not to most of them.

Really.  It's sad to say, but people in general do _not_ read directions 
and do _not_ follow procedures, even when they are carefully trained in 
procedures specifically designed to protect against particular threats, and 
even when the threat is to the user's life or safety.

How do you expect users to remember not to give away their passwords when 
they can't be bothered to remember to wash their hands or look both ways 
before crossing a street?

-- Jeff