On Sun 27/Sep/2020 15:06:24 +0200 Dave Crocker wrote:
On 9/27/2020 2:20 AM, Alessandro Vesely wrote:
On Sat 26/Sep/2020 15:06:54 +0200 Dave Crocker wrote:
On 9/26/2020 3:31 AM, Alessandro Vesely wrote:
A pointer to a better aimed report circulated on this list:
An unrefereed presentation (not paper) about a single experiment is better
than a summary of an industry-wide effort that failed?
I meant aimed at email rather than web browsing.
So?
If you think the industry-wide experiment that focused on signalling a trust
indicator and failed is less relevant than a small, single, unrefereed paper
about a preliminary and poorly-design research project is somehow less
relevant, please explain.
I think an industry-wide experiment on petrol consumption has nothing to do
with email protocols, however refereed. Web browsing has a minor share with
email, as some people use browsers instead of MUAs. Browser security concerns
are rather oriented toward shopping and EV certificates, than email phishing.
And, for the current discussion, there's the troublesome summary the they
give about their own study:
1. Warning only slightly lowers the click rate
2. The absolute click rate is still high
The key words there are "slightly" and "still high".
"If one person eats a chicken and another person doesn't eat anything, on
average they both ate half a chicken". That's how statistics distorts reality.
The fact that you think this statement is somehow meaningful suggests a
rejection of an entire, established field of study based on not understanding it.
Statistics can easily be misused. Distinguishing a cluster of overweight
people from starving communities doesn't reject statistics as a whole.
I'm sure there are users who watch authentication results, and usually take
no bait. For them, "slightly" and "still high" don't hold.
Except that individual cases are not the basis for establishing industry-wide
practice. Industry-wide behaviors are.
An occasional example simply isn't relevant. That's the difference that
legitimate statistical analysis provides.
The statistical aspect of email is that it is mostly spam, at varying shades of
gray. Meaningful messages can be regarded as occasional exceptions in this
respect. Nevertheless, they are important.
And, there's increasing activity about anti-phish employee training. As a
consequence, the importance of visual hints is bound to increase.
Excellent. So that means you can point to studies that show how effective such
training is. Because the general sense is in the anti-abuse community is that
it has little effect. But if you know of studies to the contrary, it would
very useful to hear about them.
Google Scholar shows me 83 results about anti-phish training effectiveness.
Just talking about human-oriented solutions for phishing entails that users
need to interpret visual cues. Hence visual cues have some effect, however little.
Discarding the importance of of users judgement provides for a skewed vision.
Filtering out obvious spam can be considered a favor to users, to keep their
mailboxes cleaner. Yet, a deterministic protocol which determines what to
reject and what to quarantine would relieve MX operators from the
responsibility of arbitrary filtering based on obscure secrets.
Prompting the question of why anyone would think this study serves as
demonstrating strong support for the role of end-users in abuse protection?
That wasn't the goal of the presentation, AFAIUI.
However it /was/ the apparent reason it was cited.
Yup.
All of which demonstrates a basic problem with efforts to discuss
human-related work: difficulties in understanding how to evaluate research
and research patterns, with a tendency to instead lean on confirmation bias.
That's why it is important to enable each and every soul to exert their own
judgements.
Actually, it's not.
Why have elections at all if the result can be forecast before the votes are
counted?
Best
Ale
--
_______________________________________________
dmarc mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/dmarc
