Security Engineering: A Guide to Building Dependable Distributed Systems, Second Edition

Chapter 2. Usability and Psychology

Humans are incapable of securely storing high-quality cryptographic keys, and they have unacceptable speed and accuracy when performing cryptographic operations. (They are also large, expensive to maintain, difficult to manage, and they pollute the environment. It is astonishing that these devices continue to be manufactured and deployed. But they are sufficiently pervasive that we must design our protocols around their limitations.)

—— Kaufmann, Perlman and Speciner [698]

Only amateurs attack machines; professionals target people.

—— Bruce Schneier

Introduction

Many real attacks exploit psychology at least as much as technology. The fastest-growing online crime is phishing, in which victims are lured by an email to log on to a website that appears genuine but that's actually designed to steal their passwords. Online frauds like phishing are often easier to do, and harder to stop, than similar real-world frauds because most online protection mechanisms are not anything like as intuitively usable or as difficult to forge convincingly as their real-world equivalents; it is much easier for crooks to build a bogus bank website that passes casual inspection than it is for them to create a bogus bank in a shopping mall.

We've evolved social and psychological tools over millions of years to help us deal with deception in face-to-face contexts, but these are little use to us when we're presented with an email that asks us to do something. It seems to be harder ...